text: All of the Company's personnel are employees of the Manager or one of its affiliates and are subject to the Manager's policies and procedures. Our Manager utilizes a third-party managed & cybersecurity services provider (the "MSSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our Manager and the MSSP engage in periodic assessment and training regarding the policies, standards and practices designed to address cybersecurity threats and incidents. Our cybersecurity risk management is integrated into our overall enterprise risk management and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management.


text: To date, we have not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company and we are not aware of any cybersecurity threats that are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Risk Factors—General Risk Factors—We rely on information technology in our operations, and security breaches and other disruptions in our systems could compromise our information and expose us to liability, which would cause our business and reputation to suffer."

companyName: Advanced Flower Capital Inc.

ticker: AFCG

secItem: Item 1C


text: The Company's Audit and Valuation Committee oversees the Company's cybersecurity risk management process. The Audit and Valuation Committee has adopted a charter that provides that the Audit and Valuation Committee must periodically review and discuss with the Company's management team the Company's guidelines and policies with respect to risk assessment and risk management of cybersecurity and other risk exposures relevant to the Company's computerized information system controls and security. The Audit and Valuation Committee may receive additional training in cybersecurity and data privacy matters to enable its oversight of such risks. The Audit and Valuation Committee will report to the Board on the substance of such reviews and discussions and, as necessary, recommend to the Board such actions as the Audit and Valuation Committee deems appropriate.


text: As noted above, the Company relies on the Information Systems in connection with the Company's day-to-day operations. The Company relies on the MSSP's processes for assessing, identifying, and managing material risks from cybersecurity threats.


text: The Company's Chief Financial Officer and Treasurer, Chief Legal Officer and Secretary, and Head of IT work collaboratively with other employees of our Manager or its affiliates and the MSSP to ensure the MSSP's services protect the Company's Information Systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. These members of the Company's management team, together with the MSSP, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Audit and Valuation Committee when appropriate. These members of the Company's management team meet periodically to assess cybersecurity risks and discuss with the Audit and Valuation Committee. They have gained relevant knowledge, skills and experience in information technology and cybersecurity risk management, including overseeing third-party vendors in such areas, through their roles at the Company or other organizations.


text: We have an enterprise-wide risk management framework for identifying, assessing, managing, monitoring, and reporting our material risks, including cybersecurity risks. Our risk identification and risk and control self-assessment ("RCSA") process assesses the potential likelihood and impact of, among other things, cybersecurity risks to the Company, and the control environment in place to mitigate identified risks. See Item 1A. Risk Factors – "Risks Related to Information Technology, Security and Data" for a description of the cybersecurity risks we face.

companyName: Jackson Financial Inc.

ticker: JXN


text: The Company is committed to attaining the highest standards for information security and data privacy programs through disciplined governance and risk management practices.


text: We have a written JFI Information Security Policy setting forth our expectations with respect to the receipt, handling and management of information, and setting forth our process, procedures and standards for achieving those expectations. Our Information Security Policy is reviewed and updated by management at least annually, to align with multiple industry standards, including the National Institute of Standards and Technology Cyber Security Framework and relevant state regulations, including New York's Department of Financial Services Cybersecurity Requirements for Financial Services Companies, and federal regulatory requirements. The JFI Privacy Policy is also annually reviewed and updated by management to align with industry best practices and state and federal regulatory requirements.


text: Our cybersecurity program includes a threat and vulnerability management program to identify, assess, prevent, detect, monitor and remediate internal and external threats to, and vulnerabilities of, the Company's electronic systems, applications and data. Key components of this security program include a 24/7 Security Operations Center, which is managed internally at Jackson, with staff augmentation from third-party service vendors. The Security Operations Center monitors threats and attacks and initiates the incident response management process and associated notifications, as needed. In addition to monitoring threats and attacks, our internal management team reviews daily external threat intelligence and oversees, at least quarterly, external penetration testing of our Company's electronic systems. We provide training to all associates and regularly audit and assess our program with both internal and external resources, and through benchmarking studies and assessments against our Information Security and Privacy Policies and Standards.


text: We have a third-party vendor management program that oversees the identification and assessment of cybersecurity risk for the Company's use of all third-party service providers. This program evaluates third-party vendors based on their level of access to the Company's data and the level of potential risk the third-party service providers create for the organization through reviews of their security program and systems architecture. The Company identifies monitoring and mitigating controls and implements such controls where appropriate for any identified risks, including adding robust security terms in agreed contracts. We also monitor and periodically reassess third-party service vendors to ensure controls are maintained to expectations.


text: Cybersecurity Incidents As previously disclosed in Item 2. Management's Discussion and Analysis of Financial Condition and Results of Operations— Macroeconomic, Industry and Regulatory Trends — Cybersecurity Event in our Form 10-Q for the quarter ended June 30, 2023, Jackson determined that its information at one of our third-party vendors, Pension Benefit Information, LLC ("PBI"), was impacted by a cybersecurity breach involving Progress Software Corporation's MOVEit Transfer software. The PBI service helps Jackson to identify possible beneficiaries for death benefits. According to PBI, an unknown actor exploited a MOVEit software flaw to access PBI's systems and download certain data. Our assessment indicated that personally identifiable information relating to approximately 850,000 of Jackson's customers was obtained by that unknown actor from PBI's systems. PBI informed Jackson that it rectified the MOVEit vulnerability.


text: Separately, Jackson experienced unauthorized access to two servers as a result of the MOVEit flaw; however, the scope and nature of the data accessed on those servers was significantly less than the PBI impact. Our assessment was that a subset of information relating to certain partner organizations and individuals, including certain customers of Jackson, was obtained from the two affected servers.


text: At this time, we do not believe the incidents or related litigation will have a material adverse effect on the business, operations, or financial results of Jackson Financial.


text: JFI's Board Oversight of Risks from Cybersecurity Threats: JFI's Board approved both the Company's initial JFI Information Security Policy and the JFI Privacy Policy. The Finance and Risk Committee of the JFI Board assists the Board with oversight of the Company's risk framework and its effectiveness. The Finance and Risk Committee regularly reviews top risks identified by management, the Company's risk appetite, and financial and non-financial risks, including information security and cybersecurity. The committee also reviews activity reports on the status of our cybersecurity program, including material policy changes, breaches, and remediation actions. At least annually, and more often as needed, the committee meets with our Chief Information Security Officer ("CISO") in a dedicated session to review and discuss in-depth cybersecurity risks facing the Company.


text: JFI's Board of Directors receives periodic reports from its Finance and Risk Committee regarding the committee's actions in respect of cybersecurity and related regulatory developments and receives from our CISO regular updates about cybersecurity threats and our cybersecurity and privacy programs.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats: Our CISO is a member of the senior leadership team and oversees our Information Security and Privacy Team. The CISO provides regular updates to the Board on cybersecurity threats facing the organization, including developments in our ongoing information security and privacy programs. As noted, the CISO meets in dedicated sessions with the Finance and Risk Committee to review and discuss in-depth cybersecurity risks facing the Company.


text: Our Information Security and Privacy Team includes 70 full-time positions with at least 50% of our associates holding industry certifications, such as the Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Privacy Professional (CIPP). All associates and contractors with access to our Company's systems receive comprehensive initial and ongoing annual training on responsible information security, data security, and cybersecurity practices and how to protect against cyber threats.


text: Regular independent third-party assessments, penetration testing, and internal audits are conducted to validate controls and to position our cybersecurity maturity level at or ahead of industry trends in meeting stringent security standards. We regularly assess our security program internally and externally, through benchmarking studies and assessments against our Information Security and Privacy Policies and Standards and conduct assessments of the effectiveness of relevant internal control activities designed to restrict inappropriate access to our IT systems, support data integrity within our IT systems, and ensure ongoing availability of our IT systems. Certain of these control activities are also subject to an assessment by our external auditor to support its opinion on the effectiveness of our internal control over financial reporting.


text: Part I | Item 1C. Cybersecurity Our cybersecurity program includes a threat and vulnerability management program to identify, assess, prevent, detect, monitor and remediate internal and external threats to, and vulnerabilities of, the Company's electronic systems, applications and data. Key components of this security program include a 24/7 Security Operations Center, which is managed internally at Jackson, with staff augmentation from third-party service vendors. The Security Operations Center monitors threats and attacks and initiates the incident response management process and associated notifications, as needed. In addition to monitoring threats and attacks, our internal management team reviews daily external threat intelligence and oversees, at least quarterly, external penetration testing of our Company's electronic systems. We provide training to all associates and regularly audit and assess our program with both internal and external resources, and through benchmarking studies and assessments against our Information Security and Privacy Policies and Standards.


text: Cybersecurity Incidents We are not aware of any material cybersecurity events that are likely to have a material effect on our business strategy, results of operation or financial condition.


text: JFI's Board Oversight of Risks from Cybersecurity Threats: JFI's Board approved both the Company's initial JFI Information Security Policy and the JFI Privacy Policy. The Finance and Risk Committee of the JFI Board assists the Board with oversight of the Company's risk framework and its effectiveness. The Finance and Risk Committee regularly reviews top risks identified by management, the Company's Risk Appetite, and financial and non-financial risks, including information security and cybersecurity. The committee also reviews activity reports on the status of our cybersecurity program, including material policy changes, breaches, and remediation actions. At least annually, and more often as needed, the committee meets with our Chief Information Security Officer ("CISO") in a dedicated session to review and discuss in-depth cybersecurity risks facing the Company.


text: Our Information Security and Privacy Team includes over 70 full-time positions with at least 50% of our associates holding relevant industry certifications, such as the Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Privacy Professional (CIPP). All associates and contractors with access to our Company's systems receive comprehensive initial and ongoing annual training on responsible information security, data security, and cybersecurity practices and how to protect against cyber threats.


text: Part I | Item 1C. Cybersecurity Regular independent third-party assessments, penetration testing, and internal audits are conducted to validate controls and to position our cybersecurity maturity level at or ahead of industry trends in meeting stringent security standards. We regularly assess our security program internally and externally, through benchmarking studies and assessments against our Information Security and Privacy Policies and Standards and conduct assessments of the effectiveness of relevant internal control activities designed to restrict inappropriate access to our IT systems, support data integrity within our IT systems, and ensure ongoing availability of our IT systems. Certain of these control activities are also subject to an assessment by our external auditor to support its opinion on the effectiveness of our internal control over financial reporting.


text: Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, information systems, business operations, and products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework (NIST), other global standards, and contractual requirements, as applicable. We also leverage government partnerships, industry and government associations, third-party benchmarking, audits, threat intelligence feeds, and other similar resources to inform our cybersecurity efforts and allocate resources.

companyName: MARAVAI LIFESCIENCES HOLDINGS, INC.

ticker: MRVI


text: We maintain an information security program that includes physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent and timely and effectively respond to cybersecurity incidents. Through our cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of cybersecurity risk countermeasures made to defend against such threats. This process has been integrated into our Enterprise Risk Management program and our Compliance Risk Management program, both of which are overseen by our Board of Directors. In addition, we engage third-party consultants to assist us in assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs, including conducting penetration testing, phishing campaigns, and vulnerability assessments, and responding to any incidents.


text: We also assess the risks from cybersecurity threats of our suppliers and third-party service providers. We also require our suppliers and third-party service providers to adopt security-control principles based on NIST or similar global standards.


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations, and reputation. Although our cybersecurity risk management processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. See "Our internal computer systems, or those of our customers, collaborators or other contractors, have been and may in the future be subject to cyber-attacks or security breaches, which could result in a material disruption of our product development programs or otherwise adversely affect our business, financial condition, results of operations, cash flows and prospects" within Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our Board has overall responsibility for risk oversight. Oversight of certain of the Company's key risks is specifically allocated to Board committees based on their respective areas of expertise. The Nominating, Governance and Risk Committee assists the Board in overseeing risks specific to cybersecurity. Pursuant to its written charter, the Nominating, Governance and Risk Committee is charged with overseeing our management's efforts to identify, evaluate and mitigate major risks related to cybersecurity, data protection controls, business continuity/disaster recovery systems and other information security matters, and periodically reviews our approach to the identification, evaluation and mitigation of such risks with the Board. Our Vice President, Information Technology ("VP of IT"), together with our General Counsel, briefs the Nominating, Governance and Risk Committee on cybersecurity risks at selected meetings. These briefings include assessments of the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. To the extent that a significant cybersecurity event occurs, the Nominating, Governance and Risk Committee would also receive periodic updates from senior management, including the VP of IT, the General Counsel, and the relevant Company third-party consultants on any significant cybersecurity events. Such updates would include, as applicable and relevant, the nature, scope and timing of the event; the type and scale of information or data has been accessed, exfiltrated or encrypted; the systems involved; what is known about the threat actor, such as capabilities and demands, if any; management's ongoing assessment of the impacts or likely impacts of the intrusion; the possibility of litigation or regulatory investigations or actions; and any other information that management finds relevant and that would aid in the assessment of the materiality of the impact of the intrusion.


text: Our Information Technology (IT) Department and Legal Department work together and are jointly responsible for developing and coordinating our enterprise-wide cybersecurity policy and strategy, including managing our cybersecurity risk management processes. The VP of IT and the General Counsel report to the Company's senior leadership team on progress towards specific cybersecurity objectives.


text: Vijay Mani is our VP of IT. He is responsible for managing our information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Mr. Mani has 16 years of experience working in leadership roles in information technology, as well as relevant degrees and certifications, including an Advanced Computer Security Certificate from Stanford University. He reports directly to our Chief Financial Officer and meets periodically with the Nominating, Governance and Risk Committee.


text: Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, information systems, business operations, and products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST"), other global standards, and contractual requirements, as applicable. We also leverage government partnerships, industry and government associations, third-party benchmarking, audits, threat intelligence feeds, and other similar resources to inform our cybersecurity efforts and allocate resources.


text: Risk Assessment and Strategy Our approach towards cybersecurity follows our enterprise risk management framework. Through this process our management identifies risks to achieving our strategy and objectives; assesses, manages, controls and monitors those risks; and communicates results, including elevation of those risks to the Risk Committee of the Board of Directors, where applicable.

companyName: Enact Holdings, Inc.

ticker: ACT


text: We employ a multi-layered approach to data security and data privacy. This approach begins with our information security program, which leverages National Institute of Standards and Technology, SP 800-53. Our program includes policies and standards that delineate requirements for the implementation and on-going maintenance of our information systems as well as security responsibilities for all personnel. We review these policies and standards periodically and update as needed. We have processes to oversee the maintenance and enforcement of our information security policies and educate personnel on their responsibilities. We maintain a "defense-in-depth" model, which employs multiple layers of protection for the Company. Among other things, we perform external and internal risk assessments, penetration testing, vulnerability scanning, secure code development and monthly security awareness training (including phishing awareness tests) for all personnel.


text: The monitoring and surveillance procedures over our key systems and IT environments are performed jointly with Genworth. Potential threats are evaluated, correlated and escalated to the extent appropriate. Incidents that are subject to escalation are initially evaluated by a team of IT security personnel led by our Chief Information Security Officer. If the incident is sufficiently severe, it will trigger our cybersecurity incident response plan, which is carried out by a cross-functional team of professionals who ultimately report findings and suggest action plans to our senior leadership team and Genworth. In accordance with the plan, we assess, contain and eradicate the threat and notify relevant external parties. We engage with third parties to assist with the research and evaluation, if deemed necessary.


text: We also consider cybersecurity threats with respect to third party service providers. Third parties who hold sensitive data are subject to our risk assessment process and vendor management due diligence procedures, which include an evaluation of cybersecurity risk.


text: We have not identified any risks from cybersecurity incidents or threats that have materially affected our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. Additional information on cybersecurity risks we face can be found in "Item 1A Risk Factors" of this Annual Report.


text: The Chief Information Security Officer, who is primarily responsible for our cybersecurity strategy and assessing and managing risks from cybersecurity threats, works together with our Chief Information Officer, Chief Risk Officer and compliance organization, as well as other functions, in administering our information security program in a manner that satisfies applicable legal and regulatory requirements. The Chief Information Security Officer has over 18 years of experience in information security, technology audit, and technology operations and includes the design, implementation, and maintenance of greenfield cybersecurity programs for regulated specialty insurance and software-as-a-service companies. The Chief Information Security Officer has a master's degree in information technology with a specialization in cybersecurity augmented with professional designations including the Amazon Web Services ("AWS") Certified Solutions Architect Associate, AWS Certified Security - Specialty, Global Information Assurance Certification ("GIAC") Cloud Security Automation, GIAC Certified Intrusion Analyst, GIAC Penetration Tester, GIAC Web Application Penetration Tester, and Certified Information Systems Security Professional. The Chief Information Security Officer receives reports on potential cybersecurity threats from throughout the business on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Further, our team strives to stay current with respect to cybersecurity threats through training and investing in the relevant tools. Our Chief Information Security Officer, Chief Information Officer and Chief Risk Officer provide regular updates and reports to our senior leaders.


text: The Risk Committee of our Board of Directors, in coordination with our management risk committee, has primary responsibility for overseeing cybersecurity, information technology and information security systems, processes, policies and risk management and the effectiveness of security controls. At least quarterly, the Risk Committee meets with management and reviews reports related to the status of our information technology related risks, which includes information such as the status of our environment, employee education, penetration testing, server patching, systems availability, as well as debriefs of Company cybersecurity tabletop exercises, director education sessions on a variety of topics concerning cybersecurity, and annual assessment. The Committee also reviews the Chief Compliance Officer's quarterly report, which includes information regarding certain data security incidents that meet the risk criteria for inclusion in the report. Management also keeps the Committee apprised of changes in the threat landscape, such as new projects or strategies that may involve cybersecurity risks, evolving trends, and cyber incidents that involve our customers and suppliers.


text: At least annually, we present a cybersecurity report to our full Board of Directors along with semiannual briefings. These sessions may cover, among other topics, the information security organization, material risks, technical threats, information technology security infrastructure, patching and vulnerability management, cybersecurity incidents, an annual cybersecurity tabletop exercise and incident preparedness, supplier management, security awareness training, cybersecurity personnel/staffing and a cybersecurity threat assessment.


text: We employ a multi-layered approach to data security and data privacy. This approach begins with our information security program, which leverages the National Institute of Standards and Technology Cybersecurity Framework. Our program includes policies and standards that delineate requirements for the implementation and on-going maintenance of our information systems as well as security responsibilities for all personnel. We review these policies and standards periodically and update as needed. We have processes to oversee the maintenance and enforcement of our information security policies and educate personnel on their responsibilities. We maintain a "defense-in-depth" model, which employs multiple layers of protection for the Company. Among other things, we perform external and internal risk assessments, penetration testing, vulnerability scanning, secure code development and monthly security awareness training (including phishing awareness tests) for all personnel.


text: The monitoring and surveillance procedures over our key systems and IT environments are performed jointly with Genworth. Potential threats are evaluated, correlated and escalated to the extent appropriate. Incidents that are subject to escalation are initially evaluated by a team of IT security personnel led by our Chief Information Security Officer. If the incident is sufficiently severe, it will trigger our cybersecurity incident response plan, which is carried out by a cross-functional team who ultimately report findings and suggest action plans to our senior leadership team and Genworth. In accordance with the plan, we assess, contain and eradicate the threat and notify relevant external parties. We engage with third parties to assist with the research and evaluation, if deemed necessary.


text: Based on the information available as of the date of this Annual Report on Form 10-K, we believe that risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and as of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, there can be no guarantee that we will not be the subject of future successful cybersecurity attacks, threats or incidents that may materially affect our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in "Item 1A Risk Factors" of this Annual Report.


text: The Chief Information Security Officer, who is primarily responsible for our cybersecurity strategy and assessing and managing risks from cybersecurity threats, works together with our Chief Information Officer, Chief Risk Officer and compliance organization, as well as other functions, in administering our information security program in a manner that satisfies applicable legal and regulatory requirements. The Chief Information Security Officer has over 19 years of experience in information security, technology audit, and technology operations and includes the design, implementation, and maintenance of greenfield cybersecurity programs for regulated specialty insurance and software-as-a-service companies. The Chief Information Security Officer has a master's degree in information technology with a specialization in cybersecurity augmented with numerous professional designations. The Chief Information Security Officer receives reports on potential cybersecurity threats from throughout the business on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Further, our team strives to stay current with respect to cybersecurity threats through training and investing in the relevant tools. Our Chief Information Security Officer, Chief Information Officer and Chief Risk Officer provide regular updates and reports to our senior leaders.


text: The Risk Committee of our Board of Directors, in coordination with our management risk committee, has primary responsibility for overseeing cybersecurity, information technology and information security systems, processes, policies and risk management and the effectiveness of security controls. At least quarterly, the Risk Committee meets with management and reviews reports related to the status of our information technology related risks, which includes information such as the status of our environment, employee education, penetration testing, server patching, systems availability, as well as debriefs of Company cybersecurity tabletop exercises, director education sessions on a variety of topics concerning cybersecurity, and annual assessment. The Risk Committee also reviews the Chief Compliance Officer's quarterly report, which includes information regarding certain data security incidents that meet the risk criteria for inclusion in the report. Management also keeps the Risk Committee apprised of changes in the threat landscape, such as new projects or strategies that may involve cybersecurity risks, evolving trends, and cyber incidents that involve our customers and suppliers.


text: At least annually, management presents a cybersecurity report to our full Board of Directors along with semiannual briefings. These sessions may cover, among other topics, the information security organization, material risks, technical threats, information technology security infrastructure, patching and vulnerability management, cybersecurity incidents, an annual cybersecurity tabletop exercise and incident preparedness, supplier management, security awareness training, cybersecurity personnel/staffing and a cybersecurity threat assessment.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the Federal Financial Institutions Examination Council (the "FFIEC"), the International Organization for Standardization and other applicable industry standards and regulations, including regulations promulgated by the NYDFS. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the data and information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company's strategy is informed by determinations of inherent risk and risk maturity level that are made in connection with an independent cybersecurity awareness assessment prepared for the FFIEC.


text: As one of the critical elements of the Company's overall ERM approach, the Company's Information Security Program is focused on the following key areas: • Protecting the confidentiality, integrity, and availability of information systems and the nonpublic information stored on them. • Identifying risks, defending against unauthorized access, and detecting, responding to, and recovering from cybersecurity incidents.


text: Role of Management The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: The Company has also established a governance structure and organization to manage cybersecurity risk. This includes escalation and reporting of cybersecurity incidents through the Chief Risk Officer's organization to an Executive Response Team and the Board, and periodic reporting on the Information Security Program to the Information Cyber Security Subcommittee of the Enterprise Risk Management Committee, an executive committee that oversees the Information Security Program, and the Enterprise Risk Oversight Committee (the "EROC"), the Board committee that oversees the ERM framework.


text: The Chief Information Security Officer ("CISO"), under the supervision of the Company's Chief Risk Officer ("CRO") in coordination with the Company's executive team, which includes our CEO, CFO, Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO"), works collaboratively across the Company to implement the Information Security Program, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans.


text: The CISO coordinates all aspects of the Information Security Program and presents a report on the Information Security Program to the Information Cyber Security Subcommittee on a quarterly basis so that the Subcommittee is made aware of a wide range of topics including recent developments in the Information Security Program, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: In the absence of a permanent CISO at December 31, 2023, the Company contracted an interim CISO who previously had served as the Company's interim CTO from July of 2022 through October of 2023. Additionally this contractor served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Officer and Chief Technology Officer of two large public financial services companies. The interim CISO has also performed Information Security leadership roles in two technology companies assessing and managing cyber risk on large amounts of data.


text: The current CTO holds an undergraduate degree in computer science and a master's degree in business administration. and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies.


text: Role of the Board of Directors The Board's oversight of cybersecurity risk management is supported by the EROC, which regularly interacts with the Company's ERM function and the CISO.


text: The EROC oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The EROC receives regular presentations and reports on the Information Security Program, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: The EROC receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Although we have not historically experienced significant cybersecurity incidents, we and other banks are subject to attacks of increasing frequency and sophistication. Any significant breach, interruption or failure of our information systems could adversely affect our business operations and our financial condition, operating results and liquidity.


text: Technical Safeguards The Company deploys technical safeguards that are designed to protect Company's data and information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, stress testing based on top cyberattack scenarios and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning and by leveraging the Federal Reserve Bank of New York methodology for cyber risk ("FFIEC CyberSecurity Assessment Tool"). The Company regularly engages third parties to perform independent assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the EROC, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's timely and effective response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Executive Response Team of the Company and as guided by the Company's Chief Risk Officer, to the Risk Committee when appropriate.


text: The Company's Security Incident Response Team ("SIRT") structure includes an Executive Response Team ("ERT"). The ERT is composed of all members of the Executive Management Team, the Head of Business Continuity Management, and the CISO (if the incident is due to a cyber breach), and it oversees a Management Response Team ("MRT"). In the event of a security incident, the Company's designated Response Coordinator, who is the Information Security Manager or the CISO's designee, shall investigate the reported security incident and assign an initial severity level. They will gather initial facts about the security incident, analyze information it has received, identify those entities affected by the security incident, assess the preliminary severity and extent of the damage (which can be financial or reputational).


text: If the severity is assessed as Low or Medium in accordance with criteria identified in the incident response and recovery plans, the Response Coordinator will report the incident to the CISO and complete the remediation actions for the cybersecurity incident and report the final outcome to the CISO. The CISO will report to the ERT remediation of Low or Medium cybersecurity incidents at least on a quarterly basis. If the cybersecurity incident is classified as a High, or at the Response Coordinator's discretion, the Response Coordinator will report the cybersecurity incident to the CISO and promptly convene the ERT. The ERT will determine the appropriate steps necessary to respond to the cybersecurity incident and oversee the MRT's execution of the response. The ERT will determine whether the cybersecurity incident needs to be escalated to the Board.


text: The Company's Vendor Management Program provides a risk-based approach to the assessment, measurement, monitoring, and control of risks related to third parties with whom the Company does business, including vendors, service providers and other external users of Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In particular, the Company confirms that new and existing service providers are implementing appropriate measures to protect customer information and customer information systems in conformance with the Company's requirements.


text: Education and Awareness Through its Information Security Awareness Program, the Company provides regular, mandatory training regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and effective practices.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the Federal Financial Institutions Examination Council (the "FFIEC"), and other applicable industry standards and regulations, including regulations promulgated by the NYDFS. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the data and information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company's strategy is informed by determinations of inherent risk and risk maturity level that are made in connection with an independent cybersecurity awareness assessment prepared for the FFIEC.


text: As one of the critical elements of the Company's overall ERM approach, the Company's Information Security Program is focused on the following key areas: • Protecting the confidentiality, integrity, and availability of information systems and the nonpublic information stored on them. • Identifying risks, defending against unauthorized access, and detecting, responding to, and recovering from cybersecurity incidents.


text: Role of Management The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: The Company has also established a governance structure and organization to manage cybersecurity risk. This includes escalation and reporting of cybersecurity incidents through the Chief Risk Officer's organization to an Executive Response Team and the Board, and periodic reporting on the Information Security Program to the Information Security Subcommittee of the Enterprise Risk Management Committee, an executive committee that oversees the Information Security Program, and the Enterprise Risk Oversight Committee (the "EROC"), the Board committee that oversees the ERM framework.


text: The Chief Information Security Officer ("CISO"), under the supervision of the Company's Chief Risk Officer ("CRO") in coordination with the Company's executive team, which includes our CEO, CFO, Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO"), works collaboratively across the Company to implement the Information Security Program, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans.


text: The CISO coordinates all aspects of the Information Security Program and presents a report on the Information Security Program to the Information Cyber Security Subcommittee on a quarterly basis so that the Subcommittee is made aware of a wide range of topics including recent developments in the Information Security Program, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: In 2024, the Company appointed a new Chief Information Security Officer (CISO). The new CISO has over 25 years of experience in Cyber Security, Information Security, Risk Management, and Information Technology. He has served as CISO and SVP at a financial institution, overseeing cyber and information security policies and ensuring compliance and security for new product implementations. Previously, he was VP, Head of Cybersecurity at another financial institution and held key roles at a financial services company. He is actively involved in advisory roles and professional boards, and he holds advanced degrees and certifications in information systems and security. The CISO holds a Bachelor's in Science in Managed Information Systems from Saint Peter's University, a Master of Science in Information Systems with a concentration in Information Security from Stevens Institute of Technology, Hoboken, NJ, and a Graduate Certificate in Business Process Management and Service Innovation from Stevens Institute of Technology, Hoboken, NJ.


text: Role of the Board of Directors The Board's oversight of cybersecurity risk management is supported by the EROC, which regularly interacts with the Company's ERM function and the CISO.


text: The EROC oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The EROC receives regular presentations and reports on the Information Security Program, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: The EROC receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Although we have not historically experienced significant cybersecurity incidents, we and other banks are subject to attacks of increasing frequency and sophistication. Any significant breach, interruption or failure of our information systems could adversely affect our business operations and our financial condition, operating results and liquidity.


text: Technical Safeguards The Company deploys technical safeguards that are designed to protect Company's data and information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing, stress testing based on top cyberattack scenarios and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning and by leveraging the Federal Reserve Bank of New York methodology for cyber risk ("FFIEC CyberSecurity Assessment Tool"). The Company regularly engages third parties to perform independent assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the EROC, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's timely and effective response to a cybersecurity incident, and such plans are tested and evaluated on an annual basis. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Executive Response Team of the Company and as guided by the Company's Chief Risk Officer, to the Risk Committee when appropriate.


text: The Company's Security Incident Response Team ("SIRT") structure includes an Executive Response Team ("ERT"). The ERT is composed of all members of the Executive Management Team, the Head of Business Continuity Management, and the CISO (if the incident is due to a cyber breach), and it oversees a Management Response Team ("MRT"). In the event of a security incident, the Company's designated Response Coordinator, who is the Information Security Manager or the CISO's designee, shall investigate the reported security incident and assign an initial severity level. They will gather initial facts about the security incident, analyze information it has received, identify those entities affected by the security incident, assess the preliminary severity and extent of the damage (which can be financial or reputational).


text: If the severity is assessed as Low or Medium in accordance with criteria identified in the incident response and recovery plans, the Response Coordinator will report the incident to the CISO and complete the remediation actions for the cybersecurity incident and report the final outcome to the CISO. The CISO will report to the ERT remediation of Low or Medium cybersecurity incidents at least on a quarterly basis. If the cybersecurity incident is classified as a High, or at the Response Coordinator's discretion, the Response Coordinator will report the cybersecurity incident to the CISO and promptly convene the ERT. The ERT will determine the appropriate steps necessary to respond to the cybersecurity incident and oversee the MRT's execution of the response. The ERT will determine whether the cybersecurity incident needs to be escalated to the Board.


text: The Company's Third-Party Risk Management Program provides a risk-based approach to the assessment, measurement, monitoring, and control of risks related to third parties with whom the Company does business, including vendors, service providers and other external users of Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In particular, the Company confirms that new and existing service providers are implementing appropriate measures to protect customer information and customer information systems in conformance with the Company's requirements.


text: Education and Awareness Through its Information Security Awareness Program, the Company provides regular, mandatory training regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and effective practices.


text: We and our third-party vendors employ information technology, including networks, systems, and applications, to support our business processes and decision-making in our business. Our information technology infrastructure supports the flow of information throughout our business processes and is susceptible to cybersecurity threats. Accordingly, we have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our customers and employees ("Information Systems and Data").

companyName: PLAYSTUDIOS, Inc.

ticker: MYPS


text: We have a cybersecurity leadership team comprised of our Chief Information Security Officer, our Head of Infrastructure, and other senior leaders on our Information Technology group ("Cybersecurity Leadership Team"). Our Cybersecurity Leadership Team works with third-party service providers to help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our Cybersecurity Leadership Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third-party enterprise threat reporting services.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risks are considered a part of our overall business strategy, financial planning, and capital allocation.


text: We use third-party service providers to assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats. Our Cybersecurity Leadership Team inventories and prioritizes information security risks and evaluates material risks from cybersecurity threats, and reports those periodically to the Audit Committee of our Board of Directors, which evaluates our overall enterprise risk.


text: To date, the Company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company. The Company, however, has experienced and expects to continue to experience cyber incidents of varying degrees. Cybersecurity threats may, among other things, cause material disruptions to our operations, which may materially affect our results of operations and/or financial condition. For more information about risks from cybersecurity threats that may materially affect us and how they may do so, see "Risk Factors — Despite our security measures, we have been subject to attacks by hackers, and our information technology and infrastructure may in the future be vulnerable to attacks by hackers or breached due to employee error, malfeasance, or other disruptions." as well as the other risk factors contained in Item 1A of this Annual Report on Form 10-K.


text: Our Board of Directors has ultimate oversight responsibility over cybersecurity-related matters and has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee assists the Board in fulfilling its oversight responsibilities with respect to the management of risks arising from cybersecurity threats and, in furtherance thereof, regularly receives reports from our senior management and Cybersecurity Leadership Team on cybersecurity matters. These reports are intended to highlight the state of our cybersecurity and data security programs, as well as our progress on key initiatives in this area. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. As appropriate, the Board also may receive information regarding specific cybersecurity incidents and resulting mitigation efforts.


text: We have a cybersecurity leadership team comprised of our Chief Information Security Officer ("CISO"), our Global Head of Infrastructure, and other senior leaders on our Information Technology group (" Cybersecurity Leadership Team "). Our Cybersecurity Leadership Team works with third-party service providers to help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our Cybersecurity Leadership Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third-party enterprise threat reporting services. The members of our Cybersecurity Leadership Team, including our CISO, have significant experience in managing and leading cybersecurity teams and in developing and implementing cybersecurity and data privacy systems and processes.


text: Processes and Risk Assessment Our cybersecurity program is focused on (i) protecting the confidentiality of business, client, investors in our products and employee information; (ii) maintaining the security and availability of our systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and our responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: We have implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that we store or process and the maintenance of critical services and systems. Our cybersecurity program is managed by our Chief Technology Officer and Head of Technology Infrastructure (together, "IT Management"), who report to our Chief Operating Officer. IT Management and its team are responsible for implementing our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and our policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Our processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with our physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to our devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of our cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Our cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on our compliance with applicable laws and regulations and our internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of our network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by IT Management for remediation. When we engage vendors and other third party partners who will have access to sensitive data or client systems and facilities, our infrastructure technology team assesses their cybersecurity programs and processes.


text: We also provide our employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. We conduct regular phishing tests and provide additional training as appropriate.


text: We have developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by our Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes our General Counsel, Chief Operating Officer, Chief Compliance Officer and IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Our cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by our Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and our Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of our cybersecurity program.


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee. Our Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on our cybersecurity program, the external threat environment and our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Item 1A. Risk Factors—Risks Related to Our Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products." Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events. See "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—We may not be able to maintain sufficient insurance to cover us for potential litigation or other risks."


text: Processes and Risk Assessment Our cybersecurity policies and processes are overseen by the Audit Committee of our Board. Our cybersecurity program is focused on (i) protecting confidential business, client, investor and employee information that we store or process; (ii) maintaining the security and availability of our systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and our responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: We have implemented an information security governance policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that we store or process and the maintenance of critical services and systems. Our cybersecurity program is managed by our Chief Technology Officer and Head of Technology Infrastructure (together, "IT Management"), who report to our Chief Operating Officer. IT Management and its team are responsible for implementing proactive and reactive measures, including our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes, and various other technological and administrative safeguards. Our cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. Our policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Our processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with our physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to our devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of our cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.


text: Our cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on our compliance with applicable laws and regulations and our internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of our network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by IT Management. When we engage vendors and other third-party partners who will have access to sensitive data or client systems and facilities, our infrastructure technology team assesses their cybersecurity programs and processes.


text: We also provide our employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. We conduct regular phishing tests and provide additional training as appropriate. We have a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: Governance and Oversight of Cybersecurity Risks We have developed an incident response framework to identify, assess, manage and report cybersecurity events, which is managed and implemented by our Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes our General Counsel, Chief Operating Officer, Chief Compliance Officer and IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of management, our Audit Committee or our Board. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with senior management and the Audit Committee or full Board, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Our cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by our Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and our Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of our cybersecurity program.


text: Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee. Our Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on our cybersecurity program, the external threat environment and our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Item 1A. Risk Factors—Risks Related to Our Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products." Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events. See "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—We may not be able to maintain sufficient insurance to cover us for potential litigation or other risks."


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: GRI Bio, Inc.

ticker: GRI


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; and • provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers who have access to employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A under the heading "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: Upon detection of a cybersecurity threat, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes, as well as the steps management has taken to respond to such risks. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, is managed by our Chief Financial Officer and supported by consultants with experience in managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs as needed. As discussed above, the Chief Financial Officer reports to our board of directors about material cybersecurity threat risks.


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our Board provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A. under the heading "We may be unable to adequately protect our internal information systems, or those used by our CROs, clinical sites, or other contractors or consultants upon which we rely, from cyberattacks, compromises, cybersecurity incidents, or other disruptions, which could result in the compromise of sensitive or proprietary information, lead to operational or service interruption, harm our reputation, and subject us to litigation, fines and other significant financial and legal exposure, and other adverse consequences," which disclosures are incorporated by reference herein.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board is responsible for the oversight of risks from cybersecurity threats.


text: Our Board receives periodic updates from management about our cybersecurity threat risk management and strategy processes. Additionally, upon detection of a cybersecurity threat, our Board receives an update from management of our cybersecurity threat risk management and strategy processes, as well as the steps management has taken to respond to such identified cybersecurity threat. Our Board also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, is managed by our Chief Financial Officer and supported by consultants with experience in managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs as needed. As discussed above, the Chief Financial Officer reports to our Board about material cybersecurity threat risks.


text: We recognize the critical importance of maintaining the trust and confidence of all our stakeholders. Our Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes, and practices are fully integrated into our risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Velo3D, Inc.

ticker: VELO


text: As one of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas:


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which receives, at a minimum, quarterly reports and presentations from our risk management function, our Vice President Information Technology (our "VP of IT") and other members of management. The Board and Audit Committee also receive prompt and timely information regarding material cybersecurity incidents as described below.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also executing controls and procedures that provide for the prompt escalation of certain material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such material incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: We have established and maintain comprehensive incident response and recovery plans to address our response to cybersecurity incidents, and such plans are tested and reviewed on an as needed basis. Our cybersecurity program includes a dedicated security incident response team (the "SIRT") responsible for identifying, investigating, and mitigating cybersecurity threats. The SIRT follows a well-defined incident response process encompassing intake, investigation, mitigation, and recovery. This process leverages tools for threat detection and utilizes standardized protocols for containment, root cause analysis, and system restoration. By integrating security measures with a robust response process, we aim to minimize the impact of potential cyber incidents.


text: Incident Reporting and Communication: We have established protocols for reporting material cybersecurity incidents to management, stakeholders, and regulatory bodies as required. The Board is promptly informed and receives ongoing updates regarding material cybersecurity incidents as described below.


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: We provide annual mandatory training for personnel regarding cybersecurity threats to equip our employees and contractors with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in an annual assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: Our Board, supported by the Audit Committee, oversees our risk management process. The Audit Committee receives, at a minimum, quarterly presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any material cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our VP of IT, in coordination with our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee basis and appropriate third-party contractors, the VP of IT, and our Head of Information Security, as well as the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report threats and incidents to the Audit Committee, as needed.


text: Our VP of IT oversees information technology ("IT") strategy, operations, cybersecurity, compliance, and business applications. They are dedicated to accelerating and scaling our company by implementing innovative technology across the company. Additionally, they are an accomplished IT executive with over 20 years of leadership experience driving transformative change across diverse industries, including manufacturing, supply chain, and software as a service. The VP of IT is a skilled technical leader proficient in technology strategy, enterprise architecture, and program management.


text: Our Head of Information Security, Governance, Risk and Compliance is CISA certified and has over 20 years of leadership experience in IT audit and governance, risk and compliance ("GRC") at companies like Google, Cisco, Federal Reserve Bank, & Vodafone. They have substantial expertise in implementing SOX compliance, NIST compliance, COSO / COBIT framework, GDPR compliance, privacy compliance, regulatory compliance, internal IT audit, ITIL/ ITSM standards and risk assessment. Additionally, they have established our enterprise risk management program and leads our infosec steering committee. They have also been instrumental in automating GRC and continuous control monitoring to drive efficiency at our company.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2023 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors—Risks Related to Compliance Matters—Aspects of our business are subject to privacy, data use and data security regulations, which could increase our costs" and "—Risks Related to Our Business and Industry—We rely on our information technology systems to manage numerous aspects of our business and a disruption of these systems could adversely affect our business."


text: The Company's cybersecurity risk management program is integrated into our overall enterprise risk management process and is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The program is comprised of a comprehensive set of policies and procedures designed to protect and identify threats to our Information Technology ("IT") systems and data, including those employed by our third-party service providers. Our dedicated cybersecurity team collaborates with business operations personnel as well as certain third parties, as applicable, to provide a comprehensive suite of cybersecurity services, encompassing network security, anti-malware solutions, email security measures, endpoint security, detection systems, application security, data safeguards, access management protocols, cybersecurity awareness initiatives, incident response strategies, threat intelligence, IT risk assessment and vulnerability management. We also maintain insurance coverage for cybersecurity incidents.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: The Company also engages third parties to perform periodic assessments of certain aspects of our cybersecurity measures, including vulnerability assessments and audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Nominating and Governance Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board of Directors has delegated oversight of cybersecurity risks to our Nominating and Governance Committee. Executive management, inclusive of our Vice President of IT ("VP of IT") in conjunction with our National Vice President of Finance ("NVP of Finance"), provides regular updates to the Nominating and Governance Committee including any updates to our program in response to new or changed cybersecurity risks, as well as ongoing metrics around the effectiveness of our existing cybersecurity strategies.


text: The VP of IT and the NVP of Finance work in coordination with the Cybersecurity Response Committee, which also includes our Chief Financial Officer ("CFO") and representatives from legal, internal audit and SEC reporting functions. In the event of a cyber incident, the Cybersecurity Response Committee utilizes a formal incident response plan based on the NIST Framework to assess and manage cybersecurity threats. The incident response plan encompasses the containment, eradication, recovery, and resolution processes for the incident, while also detailing the individuals and groups that need to be notified.


text: The VP of IT has served in various roles in information technology and information security for over 24 years, including serving as the Chief Information Security Officer of a healthcare company and a member of the cyber emergency response team at several companies. The VP of IT holds undergraduate and graduate degrees in computer science and has attained various professional certifications in cybersecurity. The NVP of Finance and the rest of the Cybersecurity Response Committee hold undergraduate and graduate degrees in their respective fields, and have over 50 years of collective experience managing enterprise risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats have not materially affected the Company, including our business strategy, results of operations or financial condition, to date. Risks relating to cybersecurity threats and potential impacts to our business strategy, results of operations or financial condition are discussed in "Risk Factors" herein.