text: Additionally, we have established a Cyber Incident Response Plan that follows the structure of the Incident Handling Guide published by the U.S. National Institute of Standards and Technology (SP 800-61r2) and that serves as an operational guide for handling cybersecurity incidents at Sandisk. Our Cyber Incident Response Plan provides procedural and strategic guidance that is designed to be flexible enough to apply to a variety of different incidents, but also specific enough to provide guidelines for incident prevention, detection, analysis, escalation and notification, and containment, eradication and recovery.


text: As part of our ongoing information security program, the Company utilizes periodic independent third-party experts to conduct assessments of our program's effectiveness. These experts are also leveraged to design and orchestrate tabletop exercises where multiple business functions and leadership levels navigate incident scenarios based on industry trends and relevant threats, to help determine our level of preparedness for various cybersecurity incidents.

companyName: Sandisk Corp

ticker: SNDK

secItem: Item 1C


text: As part of our business operations, the Company engages with a number of third parties, including but not limited to, online software service providers, vendors, consultants, and partners. These third parties are analyzed based on business criticality and impact and must be cleared through a formal cybersecurity risk assessment process before being allowed to integrate with Sandisk's information systems, access confidential data, or provide electronic services to members of our workforce.


text: The Company has in the past experienced cybersecurity incidents of varying degrees involving our technology infrastructure and information systems. While these incidents have at times resulted in some disruptions to our business operations, as of the date of this Annual Report on Form 10-K, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats or that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under "The compromise, damage or interruption of our technology infrastructure, information systems or products by cybersecurity incidents, data security breaches, other security problems, design defects, information system failures or other events could have a material negative impact on our business" in Part I, Item 1A., Risk Factors of this Annual Report on Form 10-K.


text: The Company has implemented a governance framework related to cybersecurity that includes operational risk-mitigation practices and Board-level cybersecurity risk oversight.


text: Our management team is charged with managing cybersecurity risk and identifying material cybersecurity risk exposures to our company and carries out this function primarily through our Information Security organization, which is led by our Chief Information Security Officer ("CISO") who has a CISO executive certification from the Heinz College at Carnegie Mellon University, a bachelor's degree in Electrical Engineering, over a decade of information security leadership, and over twenty years of consolidated IT leadership experience. Additionally, our Cyber Incident Response Plan discussed above calls for the establishment of a management Impact Assessment Committee, which consists of key leadership representatives from the organization and is convened on an ad hoc basis to assess the detailed business impact of a cybersecurity incident. The Impact Assessment Committee is led by our Chief Information Security Officer and includes key representatives from the Company's functional groups, including human resources, ethics and compliance, labor, privacy, internal audit, finance, communications, legal, risk and accounting. The Impact Assessment Committee receives updates and communications from the Security Operations Center on a fixed cadence determined by incident severity and follows our pre-established escalation framework to communicate with and include executive leadership, outside counsel and the Board of Directors, as appropriate. The Impact Assessment Committee works with the Company's internal and external legal counsel to determine and facilitate appropriate communications with the Board of Directors.


text: Our Board of Directors is responsible for overseeing the cybersecurity risk management process and exercises this risk oversight through both our full Board of Directors and its Audit Committee. Our Board of Directors has delegated to the Audit Committee the responsibility to oversee risks related to cybersecurity threats, and our Audit Committee Charter requires the Audit Committee to review and discuss with management the Company's policies with respect to risk assessment and enterprise risk management and to review the risk exposure of the Company related to the Committee's areas of responsibility, including with respect to cybersecurity. In carrying out this role, the Audit Committee meets with our Chief Information Security Officer regularly and receives at least quarterly reports on cybersecurity matters.


text: Additionally, at least annually, our Chief Audit Executive, who manages the day-to-day activities of our ERM program, reports to our Board of Directors on enterprise risk assessment under our ERM program, providing updates on key risks, status of mitigation efforts and residual risk trends, including an analysis of cybersecurity risks. Also at least annually, our Chief Information Security Officer reports to the full Board of Directors on cybersecurity matters related to or impacting our company and our business.


text: Cyber Risk Management and Strategy • We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, and routine review of our policies and procedures in an effort to identify risks and refine our practices. We engage certain external parties to enhance our cybersecurity oversight. • In an effort to deter and detect cyber threats, we perform annual phishing tests with employees. We also conduct annual cybersecurity and prevention training for employees, which may cover topics such as social engineering, phishing, password protection, confidential data protection, and mobile security, and is designed to educate employees on incident reporting. We also use technology-based tools, including third-party tools and solutions, designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. • We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems.

companyName: Bicara Therapeutics Inc.

ticker: BCAX


text: Related to Cybersecurity Risks Our Board of Directors (the "Board") has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee of the Board has primary responsibility for oversight of cybersecurity risk, pursuant to the Audit Committee charter, and periodically updates our board of directors on such matters.


text: At the management level, our cybersecurity program is managed by our Senior Director, IT, who is tasked with the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our Senior Director, IT reports to the Senior Vice President, Research & Development Strategy and Operations (SVP, R&D). Our Senior Director, IT has over twenty-five (25) years of experience in information technology, and also leverages the experience of a third-party managed systems provider. Our Senior Director, IT regularly reports to the SVP, R&D, as well as to other executive management on cyber matters, as appropriate.


text: Board Oversight of Cybersecurity Matters The Audit Committee is tasked with overseeing the Company's cybersecurity matters. Pursuant to the Audit Committee's charter, one of the Audit Committee's responsibilities is to discuss the Company's major risk exposures with management, including those related to cybersecurity, and the steps taken by management to monitor and control such exposures, including the Company's risk assessment and risk management guidelines, policies and practices.

companyName: Summit Midstream Corp

ticker: SMC


text: The Audit Committee reports to the entire Board of Directors periodically regarding its oversight of cybersecurity matters. In developing such updates to the Board of Directors, the Audit Committee relies in large part on periodic updates from Company management. Management of Cybersecurity Matters The Company's management assumes executive responsibility for assessing, identifying, and managing cybersecurity risks and incidents.


text: In particular, the Senior Vice President, Engineering and Operations (SVP, E&O) reports directly to the President, Chief Executive Officer, and Chairman of the Board and holds the highest level of executive responsibility for assessing and managing all cybersecurity threats, incidents, and risks at the Company, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations.


text: The SVP, E&O holds key skills, experience, and competencies related to the management of cybersecurity matters. In particular, our current SVP, E&O has over 30 years of experience leading IT and OT physical security and cybersecurity.


text: The SVP, E&O is supported by critical internal positions within the Company, including but not limited to the Director of Information Technology, Vice President of Operational Technology and dedicated IT and OT resources with cybersecurity responsibilities. The SVP, E&O is further supported by various external parties, including but not limited to cybersecurity service providers, consultants, and other third parties engaged on an as-needed basis.


text: The Company's management has processes in place by which it is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. These processes include, but are not limited to: • Maintaining an updated inventory and management of digital assets; • Ensuring familiarity and compliance with cybersecurity frameworks, including the National Institute of Standards and Technology's Cybersecurity Framework and ISO 27001; • Updating and maintaining an internal incident response plan; • Conducting risk assessments of the Company's cybersecurity policies, practices, and tools; • Employing appropriate antivirus, anti-malware, firewall, endpoint detection and response, backup and recovery software, multifactor authentication, virtual private network, account change monitoring, patch management, web content filter, spam filter and reporting, and vulnerability management software; • Conducting regular vulnerability scans of the Company's digital and operational infrastructure; • Requiring employees to complete a Cybersecurity Awareness Program, which includes computer-based training; and • Reviewing and evaluating developments in the threat landscape.


text: The Company's management also has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. These processes include, but are not limited to: • Maintaining an inventory of all third-party vendors engaged by the Company and assessing each vendor's level of access to the Company's IT and OT systems and information; and • Implementing access controls that restrict vendor access to only specific Company systems and information necessary to perform their service.


text: The SVP, E&O provides updates to the Audit Committee at its quarterly meetings regarding management of the Company's cybersecurity matters, including any new cybersecurity threats, incidents, risks, risk management solutions, trainings or education, infrastructure upgrades, or governance changes.


text: As of March 11, 2025, the Company's business strategy, operations, or financial condition have not been materially affected by and are not likely to be materially affected by, any cybersecurity threats or incidents.


text: Related to Cybersecurity Risks Cybersecurity risk oversight is a top priority for management and our board of directors. Management is responsible for the day-to-day management of cybersecurity risks we face, while our board of directors, as a whole and through committees, is responsible for the oversight of risk management. Our incident response process contemplates that management will notify the board of directors of a material cybersecurity incident.

companyName: Newsmax Inc.

ticker: NMAX


text: To help protect the Company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps we take to reduce our vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include but are not limited to establishing information security policies and standards, regular security audits, access controls, controlled use of administrative privileges, advanced threat detection, network security, vulnerability testing, compliance audits, incident response plan, employee training, and engaging third party risk management experts. We leverage CIS (Center for Internet Security) controls as a guideline to enhance our cybersecurity risk management strategy. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation.


text: We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual cybersecurity risk assessment. Further, we conduct periodic external penetration tests to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a cybersecurity program to protect our investors, consumers, customers, employees, vendors, and intellectual property.


text: Additionally, we follow a cybersecurity incident response process that provides a framework for responding to cybersecurity incidents. The process identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, the Board and the audit committee. It also addresses requirements for our external reporting obligations. The cybersecurity incident response process is reviewed and updated, as necessary, under the leadership of the Chief Information Officer.


text: We face a number of cybersecurity risks in connection with our business. Although we did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.


text: As a part of the overall risk management system for the Company, processes are in place to assess, identify and manage material risks from cybersecurity threats. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity policy that applies to the Company and its operations. With respect to cybersecurity, the Company and the Adviser rely on the systems of Goldman Sachs, its third-party service providers and the Company's service providers.

companyName: Goldman Sachs Real Estate Finance Trust Inc


text: Goldman Sachs' cybersecurity risk management processes are integrated into its overall risk management processes. Goldman Sachs has established an Information Security and Cybersecurity Program (the "Cybersecurity Program"), administered by Technology Risk within its Engineering organization, and overseen by its chief information security officer. Goldman Sachs' chief information security officer and senior management within its Technology Risk and Operational Risk, as well as its management personnel overseeing the Cybersecurity Program, all have substantial relevant expertise in the areas of information security and cybersecurity risk management. This program is designed to identify, assess, document and mitigate threats, establish and evaluate compliance with information security mandates, adopt and apply our security control framework, and prevent, detect and respond to security incidents. The Cybersecurity Program is periodically reviewed and modified to respond to changing threats and conditions. A dedicated Operational Risk team, which reports to the chief risk officer of Goldman Sachs, provides oversight and challenge of the Cybersecurity Program, independent of Technology Risk, and assesses the operating effectiveness of the program against industry standard frameworks and risk appetite-approved operational risk limits and thresholds.


text: Goldman Sachs' process for managing cybersecurity risk includes the critical components of its risk management framework, as well as the following: • Training and education, to enable Goldman Sachs employees to recognize information and cybersecurity concerns and respond accordingly; • Identity and access management, including entitlement management and production access; • Application and software security, including software change management, open source software, and backup and restoration; • Infrastructure security, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems; • Mobile security, including mobile applications; • Data security, including cryptography and encryption, database security, data erasure and media disposal; • Cloud computing, including governance and security of cloud applications, and software-as-a-service data; • Onboarding; • Technology operations, including change management, incident management, capacity and resilience; and • Third-party risk management, including vendor management and governance, and cybersecurity and business resiliency on vendor assessments.


text: In conjunction with third-party vendors and consultants, Goldman Sachs performs risk assessments to gauge the performance of the Cybersecurity Program, to estimate its risk profile and to assess compliance with relevant regulatory requirements. Goldman Sachs performs periodic assessments of control efficacy through its internal risk and control self-assessment process, as well as a variety of external technical assessments, including external penetration tests and "red team" engagements where third parties test its defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls. Goldman Sachs uses third parties, such as outside forensics firms, to augment its cyber incident response capabilities. Goldman Sachs and its third-party service providers have a vendor management program that documents a risk-based framework for managing third-party vendor relationships (including those of the Company). Information security risk management is built into our vendor management process, which covers vendor selection, onboarding, performance monitoring and risk management.


text: The board of directors provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The board of directors receives periodic reports and updates from Goldman Sachs which generally include the overall state of the Cybersecurity Program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.


text: The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are evaluated. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurance that we have not had occurrences of undetected cybersecurity incidents. During the reporting period, the Company did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: The Company and the broader financial services industry face an increasingly complex and evolving threat environment.

companyName: SL Investment Fund II LLC


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its unitholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Adviser and the Administrator manage the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for assessing, identifying, and managing material risks from cybersecurity Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and unitholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to the Firm and the Company, to further inform the design of the Cybersecurity Program. To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to the Firm and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO/CISO, and/or Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and Board, as appropriate. The BOTC has primary responsibility for assisting the Morgan Stanley board in its oversight of significant operational risk exposures of the Firm and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.


text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the Gramm-Leach-Bliley Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the Morgan Stanley board and, in accordance with such board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the Morgan Stanley board on cybersecurity risks and threats and other related matters.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2024, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: We view managing cybersecurity risk as imperative to protecting the confidentiality, integrity, availability, and resiliency of the information and systems we use to achieve our strategic business goals and satisfy our customers and partners. To that end, we have developed a formal cybersecurity risk management program that is integrated into our broader enterprise risk processes in an effort to protect our applications, networks, and systems from risks from cybersecurity threats. We use elements of the NIST Cybersecurity Framework and other recognized industry standards to inform and guide the design of this program, though we do not purport to meet any particular technical standards, specifications, or requirements of NIST.

companyName: SailPoint, Inc.

ticker: SAIL


text: We engage with multiple teams across the business, including IT, Product, Engineering, DevOps, Legal, Human Resources, Compliance, and Sales, in an effort to address all aspects and phases of the cybersecurity risk lifecycle, including identification, assessment, treatment, monitoring, and reporting. We also engage with external independent partners on a regular basis to assess the maturity of our cybersecurity risk management program and to recommend improvements thereto, including with respect to third-party risk. We also conduct annual audits and control testing to evaluate the efficiency of our controls across the organization.


text: Key features of our cybersecurity risk management program include • A dedicated team of risk analysts who manage the program and associated activities, such as risk assessments, risk lifecycle management, control assessments, and risk reporting. • Risk assessments that are conducted by the risk team on a regular basis, which sometimes include emerging topics addressed through targeted risk assessments. • Security incident response policies and procedures to investigate and respond to security incidents, including procedures to assess the threat of relevant vulnerabilities or security incidents, and to establish remediation and mitigation actions for events. • Security awareness training campaigns assigned to our users at least twice a year covering a multitude of security and privacy topics. • Management of third-party risk, including conducting cybersecurity assessments of vendors before onboarding them, followed by ongoing monitoring for compliance with standards.


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We nevertheless face ongoing risks from cybersecurity threats that, if realized, could affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A, "Risk Factors" in this Annual Report for additional information regarding potential cybersecurity risks, particularly the risk factor titled "Cyber attacks or other cybersecurity breaches, incidents, or disruptions with respect to our networks, systems, or applications, including unauthorized access to, or disclosure or other processing of, our proprietary, confidential, or sensitive information, including personal information, could disrupt our operations, compromise sensitive information related to our business or personal information processed by us or on our behalf, and expose us to liability, which could harm our reputation and adversely affect our business, financial condition, and results of operations, and as we grow, we may become a more attractive target for cyber attacks."


text: Our Board oversees our risk management efforts and has created a dedicated cybersecurity committee to specifically oversee our cybersecurity risk policies, plans, and programs. The cybersecurity committee typically meets at least quarterly and at each regular meeting, management, including from our Chief Information Security Officer (CISO), provides an update to the committee regarding our cybersecurity risk management program, including with respect to plan design, recent cybersecurity incidents (if any), and general cybersecurity developments.


text: Our management team, including our CISO, is responsible for assessing and managing our risks from cybersecurity threats under the cybersecurity committee's oversight. Our current CISO has nearly 20 years of cybersecurity experience in both the public and private sectors. His senior public sector roles include Senior Policy Advisor and the Director of Stakeholder Engagement in the Office of the National Cyber Director, Chief of Cyber Threat Analysis at the Cybersecurity and Infrastructure Security Agency (CISA), CISO of the Pandemic Response Accountability Committee, and Deputy CISO of the Pension Benefit Guaranty Corporation.


text: Our CISO leads an internal cybersecurity team comprised of individuals with varying experience and skillsets. This team covers a variety of cybersecurity-related functions, including security operations, strategy and governance risk and compliance, program management, security architecture and engineering, vulnerability management, and product security. We also have a dedicated security operations center that is responsible for detection and monitoring of cybersecurity incidents. Our CISO takes steps to stay informed about and monitor the identification, prevention, detection, protection, mitigation, and remediation of key cybersecurity risks and incidents through various means. In the case of a security event, the security incident response plan is activated to respond to the security event. We also assess and manage our cyber risks through our internal Information Security and Privacy Governance Committee, which is composed of a cross-organizational leadership team and was formed to oversee the management, operation, and overall effectiveness of the information security management system.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") has been delegated with the oversight of the Company's risk management program, which includes the identification, assessment and management of material cybersecurity risks. A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: TIC Solutions, Inc.

ticker: TIC


text: The Company has implemented a comprehensive cybersecurity risk management program designed to protect confidentiality, integrity, and availability of critical systems and information.


text: The Company's cybersecurity program is focused on the following key areas • Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning The Company has established and maintains incident response and recovery plans to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards, and such plans are tested and evaluated on a regular basis. • Dedicated Staffing The Company maintains a Network Operations Center staffed with dedicated IT security, infrastructure, and compliance professionals who oversee risk assessments, security processes, and incident responses. • Third-Party Risk Management The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. • Outside Consultants The Company engages various outside consultants, including contractors, assessors, outside attorneys and other third parties, to among other things Assist in the design, implementation, and testing of our cybersecurity program, policies and procedures monitor Company networks, servers and endpoints to identify vulnerabilities perform assessments on the Company's cybersecurity measures, including independent reviews of the Company's information security control environment and operating effectiveness review and place cyber insurance coverages including access to various third-party vendors to support the Company, should the need arise assist the Company in ensuring ongoing compliance with applicable legal and regulatory requirements. • Education and Awareness The Company provides ongoing and annual training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: As the Company focuses on establishing its governance policies and procedures in all areas, in 2025, the Company plans to establish an Information Security Committee (the "ISC") comprised of the VP Infrastructure and Cybersecurity ("VP of IT"), Chief Information Officer ("CIO"), Chief Financial Officer ("CFO") and General Counsel ("GC"). The ISC will be the focal point for all information security activities throughout the Company and its subsidiaries. The ISC, led by the VP of IT will work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The ISC will be charged with continuous improvement and implementation of policies and procedures for incident response handling, monitoring, and addressing security risks on an ongoing basis. The ISC will also be responsible for deploying technology and information security experts to monitor security risks and advise, contain, analyze, and report on security incidents, as necessary. As described above, the Company also retains a third-party cyber security firm to work hand-in-hand with the VP of IT and, once established, the ISC, to develop and oversee a program to prevent, detect, mitigate and remediate cybersecurity incidents.


text: The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Company's Chief Information Officer, on behalf of the ISC, provides reports to the Audit Committee at least annually regarding technological risk exposure and the Company's cybersecurity risk management strategy and reports any incidents to the Audit Committee in real time. Based on these reports, the Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company is in the process of developing its Internal Audit function. which will provide quarterly updates to the Audit Committee which include an update on cybersecurity risks and related internal controls.


text: Management's Expertise The Company's CIO has over two decades of experience in technology development, management, and security, including responsibility for global portfolios of digital assets, intellectual property, and proprietary data. The CIO holds a technical undergraduate degree and a graduate business degree with a strong technical focus. Additionally, the Company's CEO, CFO, and GC each have over 15 years of experience managing enterprise risks, including cybersecurity threats, either at the Company or in similar organizations. Each executive holds undergraduate and graduate degrees in their respective fields, further reinforcing the Company's commitment to cybersecurity governance at the highest levels.


text: The Company's VP of IT, reporting to the CIO, oversees cybersecurity and IT infrastructure. The VP of IT remains continuously informed on emerging cybersecurity threats, industry developments, and evolving risk management techniques, ensuring the Company's ability to prevent, detect, mitigate, and remediate cybersecurity incidents. The VP of IT supervises internal cybersecurity teams and external service providers, assesses and manages material cybersecurity risks, and oversees risk mitigation strategies. With extensive global experience in managing complex information systems and deploying advanced cybersecurity technologies, the VP of IT also holds a recognized certification from a leading cybersecurity training and research institute.


text: Risks from Cybersecurity Threats Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: We have implemented and maintain an information security program that includes processes for the identification, assessment, and mitigation of cybersecurity risks. We conduct periodic assessments of our assets as part of our risk management process and to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standards. Our cybersecurity risk management process is a part of our overall risk management program. We also have an employee education program that includes training designed to raise awareness of cybersecurity threats. We maintain an incident response plan that outlines the legal and governance process for identifying and managing material cyber risks to our information and information systems and our framework for assessing and responding to cyber incidents, as applicable.

companyName: Sionna Therapeutics, Inc.

ticker: SION


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and communicate security incidents relating to our and our third party vendors' data and information systems. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report.


text: Related to Cybersecurity Risks Our head of information technology ( IT), who reports to the Chief Financial Officer (collectively, IT Leadership), has primary responsibility for the strategic leadership and management of our cybersecurity program. Our head of IT has over 25 years of experience building and leading information technology and security teams. Our IT Leadership works alongside other functions to maintain and implement our cybersecurity strategy. Our IT Leadership meets as circumstances warrant with other members of our management, including executive leadership, to review and update incident response procedures and other aspects of our cybersecurity program.


text: The audit committee of Sionna's board of directors has ultimate oversight over cybersecurity risk. Our IT Leadership presents to the audit committee periodically regarding cybersecurity matters, including updates on security testing and assessments, cyber risks, and related cyber strategy, as applicable. The Chief Financial Officer and the General Counsel are responsible for informing the audit committee in the event of any material cybersecurity incidents and any potential disclosure obligations arising from such incidents. The audit committee will update the board of directors on matters related to cybersecurity as needed.


text: We rely on the cybersecurity policies and procedures implemented by New Mountain Capital. New Mountain Capital has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to New Mountain Capital's Information Security Program, the New Mountain Capital Information Technology Steering Committee ("ITSC") is responsible for the development, evolution, and implementation of policies and technical measures to reasonably prevent security incidents. At times New Mountain Capital may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: New Mountain Private Credit Fund


text: New Mountain Capital uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, New Mountain Capital uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, New Mountain Capital also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected. New Mountain Capital also requires that all employees, including employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors" under the heading "The failure of cybersecurity protection systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively," which should be read in conjunction with the information above.


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of trustees on developments to the information security and cybersecurity risks facing us. Reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us. Additional information about cybersecurity risks we face is discussed in Item 1A.—Risk Factors—Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above.


text: As a VIE that is 50.1% held by FE, we rely on, and are supported by, FirstEnergy's cyber security risk management program.

companyName: FirstEnergy Transmission, LLC


text: FirstEnergy seeks to protect its customers, employees, facilities and the ongoing reliability of the electric system. FirstEnergy works closely with state and federal agencies and its peers in the electric utility industry to identify physical and cyber security risks, exchange information, and put safeguards in place to comply with strict reliability and security standards. From a security standpoint, the electric utility sector is one of the most regulated industries.


text: Risk Management and Strategy FirstEnergy has established a broad framework to assess, identify and manage material risks from cyber security threats. This program is established at the executive level, with regular reporting to, and oversight by, the FE Board as described below. At the highest level, FirstEnergy's program includes multi-layered governance by management, the FE Audit Committee, the FE Operations and Safety Committee, and the FE Board, as described in greater detail below.


text: Central management and coordination of the program helps FirstEnergy to comprehensively evaluate and protect against cyber threats. FirstEnergy's written policies and procedures identify how cyber security measures and controls are developed, implemented, and regularly reviewed and updated. FirstEnergy aims to align its cyber security program with national standards. For example, FirstEnergy has implemented and maintains a set of controls to manage cyber security risk based on the National Institute of Standards and Technology Cyber Security Framework and, for Bulk Electric System assets, the NERC Critical Infrastructure Protection standards. FirstEnergy also complies with various state laws and regulations on cyber security.


text: FirstEnergy's Cyber Security Program identifies security controls and user responsibilities for the organization to identify and manage the risk of a cyber security incident. FirstEnergy also conducts various internal and external risk assessments each year. These include required annual compliance assessments, such as requirements under the Sarbanes-Oxley Act and Payment Card Industry Data Security Standard compliance audits, as well as ad-hoc assessments driven by emerging risks, changes in FirstEnergy's environment, or benchmark/roadmap needs. Risks identified in such assessments are considered for inclusion in FirstEnergy's risk portfolio, or incorporated directly into the Cyber Security Program, and are then prioritized and addressed as needed through the organization's written policies and procedures. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, of impact on FirstEnergy and others, such as vendors and customers, if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. FirstEnergy also regularly evaluates the adequacy and sufficiency of specific controls.


text: To further protect its information and cyber assets, FirstEnergy has required since late 2022 that applicable prospective third-party vendors complete a privacy impact assessment, which is designed to identify potential privacy and cyber security risks for those vendors requiring access to personally identifiable information, and based on the results, include appropriate contractual provisions to mitigate any identified risks. In 2024, FirstEnergy also evaluated its current third-party vendors to identify which vendors had similar access to personally identifiable information and is currently reviewing the results of its analysis.


text: FirstEnergy conducts cyber security exercises and training. For example, all personnel with any form of computer system access must complete cyber security training on a recurring basis, which educates personnel on FirstEnergy's policies and procedures for using FirstEnergy systems, keeping FirstEnergy information secure, and for safe, reliable operation of electric utility systems. FirstEnergy also conducts various tests of its cyber incident response plans, disaster recovery plans and business continuity plans with key stakeholders and responders for various areas of FirstEnergy's utility and business functions. FirstEnergy's management also holds executive cyber security incident tabletop exercises to train on cyber security incident response.


text: Additionally, FirstEnergy leverages third-party security firms in various capacities to assist with various aspects of FirstEnergy's cyber security program, including risk assessments, vulnerability scans, and penetration testing. FirstEnergy uses a variety of processes to address cyber security threats related to the use of third-party technology and services, such as reviewing independent assessments of the third party's cyber/information security controls, such as Systems and Organization Controls 2 audits or other standards-based assessments, where appropriate. As part of FirstEnergy's process to continuously improve its cyber and information security programs, FirstEnergy also engages third-party subject matter experts to assess and evaluate the effectiveness of various aspects of such programs. In addition to the aforementioned efforts, FirstEnergy also strongly considers cyber security risks as a part of its overall strategy and invests heavily in sophisticated and layered security measures that use both technology and hard defenses to protect critical transmission facilities and its digital communications networks. For example, security enhancements to FirstEnergy's transmission infrastructure, such as enhanced cyber security monitoring and alarming are a key component of FirstEnergy's transmission investment program.


text: Despite the security measures and safeguards FirstEnergy has employed, including certain measures implemented pursuant to mandatory NERC Critical Infrastructure Protection standards, FirstEnergy's infrastructure may be increasingly vulnerable to such attacks as a result of the rapidly evolving and increasingly sophisticated means by which attempts to defeat security measures and gain access to information technology systems may be made. Also, FirstEnergy, or its vendors and service providers, may be at an increased risk of a cyber-attack and/or data security breach due to the nature of its business. Any such cyber incident could result in significant lost revenue, the inability to conduct critical business functions and serve customers for a significant period of time, the use of significant management resources, legal claims or proceedings, regulatory penalties, significant remediation costs, increased regulation, increased capital costs, increased protection costs for enhanced cyber security systems or personnel, damage to FirstEnergy's reputation and/or the rendering of its internal controls ineffective, all of which could materially adversely affect FirstEnergy's business, results of operations, financial condition and reputation.


text: Board Governance and Management The FE Board has identified cyber security as a key enterprise risk and prioritizes the mitigation of this risk through FirstEnergy's enterprise risk management process. Responsibility for oversight of risk management generally lies with the FE Board and the FE Audit Committee has primary responsibility to oversee enterprise risk management. To effectively manage oversight of FirstEnergy's cyber security risk management practices, since 2022, the FE Board has delegated oversight authority to each of FE's Audit and Operations and Safety Committees, respectively, as detailed in each Committees' charters. The FE Audit Committee has primary responsibility to oversee the disclosure of material cyber security incidents, as well as the general obligation to ensure the proper risk oversight structure of cyber security as part of FirstEnergy's overall enterprise risk management program and the internal controls applicable to cyber security matters. The FE Operations and Safety Oversight Committee has primary responsibility to oversee the operational aspects of FirstEnergy's cyber security policies, programs, initiatives and strategies, as well as operational risk considerations related to cyber security matters. FirstEnergy's CISO regularly provides reports at the FE Audit Committee, FE Operations and Safety Oversight Committee, and to the full FE Board. Each such Committee and the full FE Board work collaboratively to ensure fulsome oversight with the proper focus of each respective Board body. These reports include, among other things, current and emerging cyber security risks to FirstEnergy, incidents that were escalated to management during the prior quarter, including those that did not require immediate escalation to the appropriate Committee and/or full FE Board, internal and external assessments of FirstEnergy's cyber security program, and a roadmap of projects to manage its cyber security posture.


text: At the executive and management level, the CISO has primary responsibility for the development, operation, and maintenance of FirstEnergy's cyber security program. The CISO has 6 years of experience in technology risk management, all of which have been with FirstEnergy, and an additional 23 years of experience in information technology. The CISO has passed examinations and received the International Information System Security Certification Consortium Certified Information Systems Security Professional certification. The CISO reports directly to FirstEnergy's Senior Vice President, Shared Services, who is responsible for all of FirstEnergy's digital and technology services and is FirstEnergy's most senior information technology executive. Under the CISO's oversight, FirstEnergy's cyber security team implements and provides governance and functional oversight for cyber security controls and services. Cyber security processes include escalation of certain risks and incidents, including those that originate or occur at third parties, to the Senior Vice President, Shared Services, legal, and the executive leaders as appropriate based on the severity of any such risk or incident. In addition, regular updates from the cyber security teams, in conjunction with real-time escalation on an as-needed basis, are also used to update the risk landscape.


text: In the event of any significant cyber security incident involving FET or its subsidiaries, FirstEnergy's Cyber Security Incident Response Plan provides for a severity determination by the cyber security incident response team based on factors such as the number of assets affected, the likelihood of inappropriate data exposure, operational impact, reliability impact, and regulatory impact. Dependent upon the severity of an incident, it is FirstEnergy's practice to escalate the incident to the FE Senior Vice President, Shared Services, FE Chief Risk Officer, and the FE and FET senior leadership teams, including the FE Chief Legal Officer, FE and FET principal financial officers, and the FE and FET principal executive officers. Such members of management then determine whether, based on various factors, the incident requires immediate escalation to the FET Board, FE Audit Committee and FE Operations and Safety Committee, or the full FE Board.


text: Although the risks from cyber threats have not materially affected FirstEnergy's or FET's business strategy, results of operations, or financial condition to date, FirstEnergy continues to closely monitor cyber risk. Overall, FirstEnergy has implemented tactical processes for assessing, identifying, and managing material risks from cyber security threats to FirstEnergy including governance at the executive and board level of FirstEnergy's Cyber Security Program, including FE's risk management strategy and the controls designed to protect its operations. Additionally, FirstEnergy, through its Disclosure Committee, has updated its disclosure controls and procedures to ensure appropriate disclosure of any material cyber security incidents. See Item 1A. Risk Factors for additional information regarding FirstEnergy's or FET's cyber security risks. Those sections of Item 1A. Risk Factors should be read in conjunction with this Item 1C. Cybersecurity.


text: The Company maintains a cybersecurity program that establishes safeguards for protecting the confidentiality, integrity, and availability of the Company's data, technology, and information systems, and the material risks associated with the threats identified from time to time under the cybersecurity program are incorporated into the Company's corporate risk register. The program includes general controls for managing changes in and access to the Company's information technology environment, cybersecurity awareness and training programs to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite the Company's response in the event of a cybersecurity incident, and guidelines regarding system vulnerability management, third-party threat intelligence, endpoint detection and response solutions, and network security measures.

companyName: APA Corp

ticker: APA


text: The program also establishes protocols for identifying and managing material risks related to cybersecurity threats associated with the Company's use of third-party service providers. The Company monitors and oversees the material risks related to vulnerabilities, threats, and incidents impacting its third-party service providers via onboarding reviews, threat intelligence reports, and annual assessments. As an example of the Company's efforts to manage third-party cybersecurity risks, when third parties are engaged to provide software-as-a-service offerings, the Company's standard licensing terms require such third parties to utilize safeguards to protect the Company's data, in compliance with applicable standards from the International Organization for Standardization (ISO) regarding security techniques, and to notify the Company within 24 hours of becoming aware of a cybersecurity incident impacting the Company's data.


text: As of December 31, 2024, no risks from cybersecurity threats or incidents have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: The standing Cybersecurity Committee of the Company's Board of Directors assists with oversight of the Company's cybersecurity program and the material risks associated with the threats identified under the program. Given the Cybersecurity Committee's chair's previous military experience in positions relevant to information security and his NACD-sponsored CERT Certificate in Cybersecurity Oversight from Carnegie Mellon University's Software Engineering Institute, the committee benefits from his perspectives, skills, and training when reviewing and managing the Company's exposure to cybersecurity risks.


text: As stated in its charter, the Cybersecurity Committee's responsibilities include: • providing oversight of the Company's cybersecurity policies, procedures, and plans, including the quality and effectiveness of the cybersecurity program; • reviewing the Company's policies and procedures related to its preparation for, defense against, response to, and recovery from material cybersecurity incidents; • reviewing with management the plans and methodology for periodic assessments of the Company's cybersecurity program by outside professionals, including the findings of such assessments and plans to remediate any material deficiencies identified by such assessments; • overseeing the Company's management of risks related to its cybersecurity systems and processes; • reviewing with management any cybersecurity insurance program the Company may procure, including with respect to coverage and limits; and • overseeing the preparation of the Company's disclosures in its reports filed with the Securities and Exchange Commission relating to the Company's cybersecurity systems.


text: The Cybersecurity Committee also has authority to retain cybersecurity and other consultants and advisors to assist and advise the committee in its evaluation of the Company's cybersecurity program.


text: The Cybersecurity Committee receives regular reports from Company management regarding the Company's cybersecurity systems and programs, and the committee from time to time also receives updates from external cybersecurity specialists on cybersecurity trends and incidents, including those that may be particularly relevant to the Company's industry or operations. In addition, in exercising its oversight responsibilities, the Cybersecurity Committee has full access to Company management and may inquire into any matter that it considers to be of material concern to the committee or the full Board of Directors.


text: The Cybersecurity Committee reports regularly to the full Board of Directors, with respect to such matters as are relevant to the committee's discharge of its responsibilities and with respect to such recommendations as the committee deems appropriate for consideration by the Board of Directors. The Cybersecurity Committee also refers to the Audit Committee any matters that come to the attention of the Cybersecurity Committee that fall within the purview of the Audit Committee, including any matters related to the Company's internal control over financial reporting.


text: APA's Executive Vice President, Administration, is primarily responsible for identifying, assessing, and managing the material risks associated with cybersecurity threats and the incidents identified from time to time thereunder. He manages the Company's Information Security Team, which comprises cybersecurity professionals responsible for the day-to-day operation of the Company's cybersecurity program and managing the Company's threat intelligence, vulnerability management, forensics, and security architecture systems. APA's Executive Vice President, Administration, has 35 years of experience managing data and technology in the energy industry, including serving as the Company's CIO from 2015-2020. He receives regular updates from external cybersecurity specialists on emerging trends, threats, and technologies in the cybersecurity industry. The Executive Vice President, Administration, reports directly to APA's Chief Executive Officer and presents all relevant information to the Cybersecurity Committee.


text: Additionally, the Company's CyberSmart Defender Network, which is a multi-disciplinary team that includes representatives from across the Company's various departments, is responsible for raising awareness of cybersecurity issues, sharing learnings, and gaining access to advanced cybersecurity information and training.


text: Under the direction of the Executive Vice President, Administration, management's responsibilities with respect to the Company's cybersecurity program include (i) identifying and managing cybersecurity risks, (ii) coordinating cybersecurity incident response, (iii) assessing the health and maturity of the Company's cybersecurity policies, procedures, and plans, including the program, and (iv) reporting overall progress to the Cybersecurity Committee and to the full Board of Directors.


text: For additional information regarding relevant cybersecurity risks, see Item 1A Risk Factors "A cyberattack targeting systems and infrastructure used by the Company or others in the oil and gas industry may adversely impact the Company's operations."


text: The Company maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through comprehensive security measures including our technology tools, internal management and external service providers.

companyName: Primo Brands Corp

ticker: PRMB


text: The Company's Chief Information Security Officer ("CISO") is responsible for assessing, identifying, and managing our risks from cybersecurity threats. This individual has over 30 years of experience in information security positions. Our CISO holds the Certified in Risk and Information Systems Control ("CRISC") certification from the Information Systems Audit and Control Association, a leading independent cybersecurity association.


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee holds periodic discussions with management regarding the Company's guidelines and policies with respect to cybersecurity risks and receives regular reports regarding such risks and the steps management has taken to monitor and control any exposure resulting from such risks. Our CISO also leads an annual review and discussion with the full Board of Directors dedicated to the Company's cyber risks, threats, and protections and provides updates throughout the year, as warranted.


text: We have processes and a risk-based approach that align with the National Institute of Standards and Technology Cybersecurity Framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, encryption and access control, and employee training. The CISO reviews emerging threats, controls, and procedures as part of assessing, identifying, and managing risks. This review aids in the identification of material breaches at other companies, including our third-party service providers. The CISO also discusses trends in cyber risks and our strategy to defend our information against cybersecurity incidents with our Audit Committee and executive leadership team on a regular basis, in addition to the annual review and discussion with the full board. In addition to our dedicated information security and technology teams monitoring our daily operations, we engage independent third-party cybersecurity providers for managed systems security, endpoint detection and response, and threat and vulnerability management. Regular communication with these providers aids in the identification and remediation of potential threats, and we regularly review our relationships with and services from these providers against industry standards and evolving cybersecurity threats.


text: We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness trainings and supplemental trainings as needed. All employees undergo annual training and there are additional trainings for certain roles and functions. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.


text: Material cybersecurity incidents are required to be reported to the Board of Directors and to the SEC on Form 8-K. Our systems and services are vulnerable to interruptions or other failures resulting from cybersecurity attacks, such as computer viruses, ransomware, phishing, hackers, or other security issues. In addition, the rapid evolution and increased adoption of new technologies, such as artificial intelligence, may intensify our cybersecurity risks. An interruption or cybersecurity breach, disruption or misuse of our information systems, or the information systems of our third-party service providers, could have a material negative effect on our business, financial condition and results of operations but we have processes in place to mitigate these risks. As of the date of this report, in the past twelve months, we have not experienced material business disruption, monetary loss, and/or data loss as a result of phishing, business email compromise or other types of attacks, and we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we cannot guarantee that material incidents will not occur in the future.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and employee and other personal data ("Information Systems and Data").

companyName: Lionsgate Studios Corp.

ticker: LION


text: The Company's information security team, led by our Chief Information Security Officer ("CISO"), helps identify, assess and manage the Company's cybersecurity threats and risks. The information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example with automated and manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of certain environments, evaluating threats reported to the Company, conducting cybersecurity audits, vulnerability assessments, and threat assessments, conducting response exercises, and coordinating with law enforcement.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response processes, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, encryption of certain data, data segregation for certain data, network security and access controls, physical security controls, asset management, tracking and disposal, monitoring for certain systems, vendor risks management processes, penetration testing, employee training, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the CISO works with management, including the Chief Information Officer ("CIO"), to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit & Risk Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, threat intelligence service providers, penetration testing providers, dark web monitoring services, forensic investigators, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, application providers, hosting providers, supply chain resources and data back-up service providers. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process involves different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Components of the vendor risk management program include, for example, conducting risk assessments for certain vendors, reviewing certain vendors' written security programs, reviewing security assessments and responses to security questionnaires, auditing of certain vendors, vulnerability scans related to vendors, and the imposition of certain contractual information security obligations for certain vendors.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Service disruptions or failures, security incidents impacting Lionsgate or its third-party service providers' information systems, data and networks may disrupt its businesses, damage its reputation, expose it to regulatory investigations, actions, litigation, fines and penalties or have a negative impact on its results of operations including but not limited to loss of revenue or profit, loss of customers or sales and other adverse consequences."


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit & Risk Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIO and CISO. Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing certain security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CISO and CIO. Our CISO, CIO and other senior executives work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the Audit & Risk Committee for certain cybersecurity incidents.


text: The Audit & Risk Committee receives regular reports from our CIO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit & Risk Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Company has established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of its information technology systems, data, and operational continuity. The Company conducts risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of the Company's existing controls. Upon identification and assessment of risks, the Company develops and implements what management believes to be appropriate measures in order to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. The Company maintains change management processes, monitoring practices, and data protection measures designed to mitigate cybersecurity risks and regularly test its systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into the Company's overall enterprise risk assessment process.

companyName: EVI INDUSTRIES, INC.

ticker: EVI


text: The Company's information security team, which is led by the Company's Director of Information Technology and also includes the Company's Chief Financial Officer and other members of the Company's internal audit and finance departments, is responsible for assessing and managing the Company's cybersecurity risks and data protection practices. The Company's Director of Information Technology has over 10 years of experience in managing cybersecurity risks and advising on cybersecurity matters.


text: The Company's Board of Directors is responsible for the oversight of management's efforts to address cybersecurity risks. The Board of Directors has designated the Audit Committee with the responsibility of overseeing and reporting to the Board on management's handling of cybersecurity risk management and on the adequacy and effectiveness of the Company's cybersecurity risk management strategy. Management also updates the Audit Committee and the Board on an on-going basis concerning any significant cybersecurity incidents or risk exposures that have come to management's attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats.


text: During the fiscal year ended June 30, 2025, the Company did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.