text: Our cybersecurity risk management is integrated in our overall risk management program and is based on recognized cybersecurity industry frameworks and standards, including those from the National Institute of Standards and Technology, and the International Organization for Standardization. We use these frameworks, together with information collected from internal assessments, to develop policies and defined procedures for use of our information assets, access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication, malware defenses and zero trust principles. We work with internal stakeholders across the Company to integrate foundational cybersecurity principles throughout our organization's operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. Throughout the year, we regularly train our employees on cybersecurity awareness and, confidential information protection. We routinely test our employees using simulated phishing attacks. Risks from cybersecurity threats have not materially affected our company, business strategy, results of operations or financial condition; however, we remain subject to cybersecurity risks in the future. See Item 1A. Risk Factors – "Our systems, networks and business activities and those of third parties that we utilize in our operations are subject to cybersecurity and stability risks, including information technology system failures, and security breaches."

companyName: Adeia Inc.

ticker: ADEA


text: We engage third-party assessors to conduct penetration testing and measure our program to industry standard frameworks. We also have standing engagements with incident response experts and external counsel. Our information technology team led by our Vice President of Information Technology (VP of IT) frequently collaborates with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices, and industry trends.

secItem: Item 1C


text: Our cybersecurity risk management extends to risks associated with our use of third-party service providers. We routinely conduct risk and compliance assessments of third-party service providers that request access to our information assets. We re-assess our third-party vendors in an ongoing basis.


text: Our cybersecurity risk management is integrated into our comprehensive business continuity program and enterprise risk management. Our information technology team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness.


text: Governance of Cybersecurity Risk Management The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The board of directors has delegated to the audit committee the responsibility of reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The audit committee, in turn, regularly reports on its review with the board of directors.


text: Management is responsible for day-to-day implementation of risk management strategies and recommends process improvements. Our VP of IT has primary oversight of material risks from cybersecurity threats. Our VP of IT has more than 25 years of experience across various engineering, business and management roles focused on information technology, including roles at global, public companies, as well as across multiple industries including fintech, research, and high tech. Our VP of IT regularly presents updates to the audit committee regarding Company cybersecurity matters and developing industry trends.


text: We have retained an outside cybersecurity firm for our managed security services, which reports to our VP of IT. The cybersecurity firm has professionals with more than 20 years of experience working in information technology-related roles and degrees in Information Technology, including cybersecurity, Certified in Risk and Information Systems Control (CRISC), and Global Information Assurance Certifications in Security Essentials (GSEC) as an Intrusion Analyst (GCIA). The cybersecurity firm has extensive experience is supporting firms in applied knowledge of information technology governance and security frameworks that include: ISO 27000, NIST, HITRUST, ISC2, ITIL, and COBIT.


text: Management assesses our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and regular evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to management and the audit committee, such as potential threats or vulnerabilities. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our VP of IT meets with the audit committee quarterly to review our information technology systems and discuss key cybersecurity risks, and these matters are also presented to the board of directors annually. In addition, our chief financial officer reviews with the audit committee, at least annually, our global enterprise risk management program, which includes cybersecurity risks, and is also reported to the board of directors.


text: The Company is externally managed by the Adviser and has no employees or internal information systems. Thus, the Company relies on the Adviser and the Administrator, their parent company, Crescent, as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's Chief Compliance Officer (the "CCO"), together with Crescent's Head of Information Technology, oversee the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. Crescent uses various security tools and procedures that help the Company identify, escalate, investigate, resolve and recover from cybersecurity incidents in a timely manner.

companyName: Crescent Capital BDC, Inc.

ticker: CCAP


text: The CCO and Crescent also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems which have the potential to subject the Company to information technology vulnerabilities and receive reports from the Company's service providers regarding any cybersecurity threats and incidents. As part of the oversight of the Company's key service providers, Crescent engages a third-party consultant to conduct a cybersecurity assessment and preparedness analysis on such service providers on an annual basis. The CCO and the Head of Information Technology provide regular reports to the Board of Directors regarding significant risks to the Company, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board of Directors regarding material cybersecurity matters as they arise. The Company has also adopted policies and procedures designed to ensure the timely disclosure of any material cybersecurity incidents.


text: Crescent follows National Institute of Standards and Technology standards for cybersecurity risk management and has put policies, controls and multiple layers of security in place to safeguard its systems and data, including those of the Company. In particular, Crescent deploys specialized security technology and operational controls including, but not limited to firewalls, anti-virus systems, multi-factor authentication, restricted access, and electronic surveillance/monitoring. Crescent conducts regular testing to assess information technology vulnerabilities and employee cybersecurity awareness, utilizes third-party technology solutions for real-time vulnerability management, and engages third-party consultants to conduct cybersecurity assessment and preparedness analyses periodically. Crescent also requires all employees, including those of the Adviser and the Administrator, to complete comprehensive cybersecurity training at least annually.


text: Crescent's Head of Information Technology has over 30 years of experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Our CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures to address such risks. Team members who support our information security and compliance programs also have relevant educational and industry experience.


text: Since our commencement of operations, we have not experienced a material cybersecurity incident and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition.


text: See "Item 1A. Risk Factors— Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of its confidential information and/or damage to its business relationships"


text: PACCAR maintains a comprehensive cybersecurity management and governance program, which includes the Company. The Company's information security management system is based upon the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The Company engages internal and third-party auditors and other professional parties when necessary, as part of its cybersecurity management program. The Company conducts penetration and compromise assessment tests, implements detection and prevention tools, monitors cyber events and has active disaster recovery plans. For third-party IT services, the Company conducts an architectural, privacy and security analysis of their solution. If any gaps are identified, the third-party remediates or mitigates the risk to an acceptable level. The Company simulates potential cyber-attacks and performs incident responses to test PACCAR Financial Corp. (Millions of Dollars)

companyName: PACCAR FINANCIAL CORP


text: preparedness. These exercises are used to train and update the Company's Incident Response plan, including any gaps identified. The Company conducts yearly information security training for employees and conducts ongoing phishing tests.


text: PACCAR's Security Risk Council, which includes the Company's Management and PACCAR's Chief Information Security Officer, meets regularly to cover risks, plans and updates to the security program. It briefs the PACCAR Board of Directors and/or the Audit Committee of the Board of Directors on technology and information security matters. Management and the PACCAR Board of Directors also receive periodic updates on the status of cybersecurity investments to guard against such events. In the event of a security breach, the PACCAR's Security Risk Council evaluates its significance and briefs the PACCAR Board on the event.


text: The Company has not experienced any notable security incidents that would have a material impact on the results of operations and financial condition of the Company. Certain PACCAR dealers and suppliers have reported they have experienced cyberattacks and those have not caused any material impact to PACCAR or the Company.


text: Trustmark recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats. Trustmark is committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard its systems and data.

companyName: TRUSTMARK CORP

ticker: TRMK


text: Trustmark's Board of Directors has ultimate oversight of cybersecurity-related risks and it is assisted in this role by the Enterprise Risk Committee and the Audit Committee. Processes for identifying, assessing and managing cybersecurity-related risks are integrated into Trustmark's overall enterprise risk management process, which is overseen by the Enterprise Risk Committee. The Enterprise Risk Committee is responsible for monitoring risks that are being taken by Trustmark, understanding the enterprise-wide effect of those risks and reporting such risks to the Board. In fulfilling this role, the Enterprise Risk Committee has primary oversight responsibility over management's efforts to manage and mitigate cybersecurity-related risk and reviews and approves Trustmark's cybersecurity strategy for protecting Trustmark's information assets and technology platforms. The Audit Committee oversees Trustmark's Internal Audit Department, which conducts reviews and assessments related to information security. Management provides periodic reports to the Enterprise Risk Committee and the Audit Committee, both of which provide reports of their meetings to the full Board. These reports to the Board and its Committees address the threat environment, vulnerability assessments, specific cyber incidents and management's efforts to monitor, detect and prevent cyber threats.


text: Trustmark's information security program is primarily administered at the management level by the Information Security Department, which is led by Trustmark's Chief Information Security Officer (CISO), and is supported by the Information Technology Department, which is led by Trustmark's Chief Information Officer (CIO). The CISO reports to the CIO, who in turn reports to Trustmark's Chief Credit and Operations Officer. Trustmark's Information Security Department is responsible for day-to-day management of Trustmark's information security program, including data loss prevention, access control, threat monitoring, incident response, insider threat monitoring and employee education and training. The Information Security Department also maintains policies related to cybersecurity and data security that provide the required governance for the information security program. Additionally, Trustmark's Information Technology Department maintains policies that govern technical aspects of Trustmark's information security program. Each policy is reviewed and approved by the Enterprise Risk Committee at least every three years and is mapped to applicable regulatory guidance. The Cybersecurity Operations team within the Information Technology Department maintains and runs Trustmark's security operations center and is responsible for cybersecurity event management and maintaining security tooling. Trustmark also maintains an Information Security / Cybersecurity Management Committee, which is comprised of representatives from the Information Security, Information Technology, Enterprise Risk, Corporate Security, Internal Audit and Legal departments and members of executive management. This committee meets quarterly to discuss and review Trustmark's information security program and receives qualitative and quantitative update reports from the Information Security Department, Internal Audit Department and Information Technology Department.


text: Trustmark engages third party assessors, consultants and auditors in connection with its information security program, including to conduct external penetration testing, independent audits and risk assessments. Trustmark also utilizes third party service providers in the ordinary course of business. The Information Security Department performs information security assessments for third party service providers that store or process Trustmark confidential data. These information security assessments include a review of any systems and organization control reports, proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes and third party data protection controls (which can include, but is not limited to: access reviews and controls, backups, monitoring, encryption standards and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.


text: As a regulated financial institution, Trustmark is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation – Financial Privacy Laws and Cybersecurity" included in Part I. Item 1 – Business of this report.


text: Although Trustmark has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that Trustmark will not experience such an incident in the future. For additional information regarding the risk Trustmark faces from cybersecurity threats, please see the risk factors titled "Trustmark may experience disruptions of its operating systems or breaches in its information system security" and "Trustmark must utilize new technologies to deliver its products and services, which could require significant resources and expose Trustmark to additional risks, including cyber-security risks" included in Part I. Item 1A. – Risk Factors of this report.


text: We have an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, detect, escalate, investigate, and remediate identified risks and security incidents in a timely manner. We also maintain a third-party security program to identify, prioritize, assess, mitigate, and remediate third-party risks; however, we often rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: ManpowerGroup Inc.

ticker: MAN


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security controls and leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, red team exercises, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also engage an independent industry recognized security service provider to conduct an annual red team assessment of our security controls, as well as third-party penetration testing of our information systems. The results of these assessments are reported to senior management and the Audit Committee of the Board of Directors.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations and the services we provide to clients as well as loss, misuse or theft of personal information (candidates, associates, vendors, clients and employees) and other data, confidential information or intellectual property, and we have experienced data exposures in the past. However, to date these incidents have not had a material impact on our services, information systems or business. Any significant disruption to our services or access to our systems could result in a loss of clients and adversely affect our business and results of operations. Further, a penetration of our information systems or a third-party's information systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. See Item 1A of Part I, "Risk Factors," under the heading "We could incur liabilities or suffer reputational damage from a cyberattack or improper disclosure or loss of personal or confidential data, and our use of data is subject to complex and ever-changing privacy and cybersecurity legal requirements that could negatively impact our business or subject us to claims and/or fines for non-compliance," which should be read in conjunction with the information above.


text: The Chief Information Security Officer (CISO) leads our global information security organization responsible for overseeing the Company's information security program. Our CISO has over 30 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at various technology companies. The global information security organization provides regular reports to senior management on various cybersecurity threats, assessments and findings.


text: The Audit Committee of the Board of Directors oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Board of Directors oversees our cybersecurity risk and regularly receives reports from our CISO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Our Processes Regarding Cybersecurity Threats We apply a layered approach, or a defense-in-depth strategy to cybersecurity. This layered approach to security leverages governance, people, processes, and technology to provide our information technology ("IT") teams with preventative measures and strategies such that they are prepared to respond to cybersecurity threats and incidents.

companyName: HERBALIFE LTD.

ticker: HLF


text: We have process, controls and technology infrastructure to maintain, protect, and enhance existing systems and design new systems to keep pace with continuing changes in technology, evolving industry and regulatory standards, and emerging cybersecurity and data security risks.


text: We collect, process, and analyze threat intelligence data from a variety of sources to understand motives, targets, and attack behaviors.


text: Another aspect of our security program is vulnerability management, which includes, among other things, asset discovery and inventory, third-party vulnerability scanners, patch management and remediation, configuration management, as well as penetration testing.


text: We have monitoring systems which are designed to identify potential cybersecurity events, including threats and incidents. These monitoring systems are managed by our Global Security Operations Center, which employs cybersecurity professionals in the United States and in certain foreign countries in which we operate to provide better coverage and response actions.


text: We also use a Security Information and Event Management (SIEM) platform, providing real-time analysis of security alerts generated by applications and network hardware. This platform helps the Global Security Operations Center in monitoring and responding to security events.


text: We have a multi-functional incident response plan which provides guidance in the event of a cybersecurity incident. The plan is managed by our Incident Management Team, which includes representation from our Global Security, Cybersecurity, Legal, and Finance departments, among others. The Incident Management Team is responsible for responding to an incident, including tasks such as identifying and assessing the nature of the incident, containing the incident, and coordinating with relevant departments. Depending on the nature or severity of the event, the Incident Management Team may escalate the matter to our Executive Leadership Team, which includes the Chief Executive Officer, Chief Operating Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel, and other executives. If necessary, the matter could be escalated to our Board of Directors or any appropriate Board committees, including the Audit Committee, which has oversight responsibility for cybersecurity risk. This structured governance approach is designed to manage cybersecurity incidents with participation and involvement with the appropriate levels of our organization.


text: External and internal audits are conducted periodically to assess the effectiveness of our cybersecurity measures. These audits include an annual technology risk assessment by our Cybersecurity and IT departments. Our Internal Audit team also conducts cybersecurity risk assessments which include, among other things, evaluating governance of our cybersecurity processes and functions, assessing our ability to identify, validate and remediate vulnerabilities, and evaluating penetration studies. Results of our Internal Audit assessments are shared with our Enterprise Risk Management ("ERM") team, our Technology Risk Committee, and in accordance with our governance structure which includes, among other things, the Audit Committee of our Board of Directors.


text: We conduct vendor security assessments for key service providers including as part of our vendor onboarding process and as part of our contract review process. The cybersecurity assessment process includes considerations from an industry leading third-party vendor security ratings company.


text: Our standard agreements with third parties may include, among other provisions, compliance requirements, data protection standards, audit rights, and security incident notification requirements. A dedicated email account and hotline is in place for third parties to report security incidents. The email account and hotline are monitored 24/7/365 by our Global Security Operations Center. Notice of a third-party security incident could trigger the activation of our incident response plan, as further described above.


text: Governance and Risk Management Systems Our risk management system includes several risk management functions that support our processes for identifying, assessing, and controlling risks to our business, including cybersecurity risks.


text: Our cybersecurity risk management process is integrated with our overarching risk management system, led by our ERM team, and further guided by our Technology Risk Committee. Our Technology Risk Committee is responsible for reviewing and approving the effectiveness of our cybersecurity risk framework and assisting with the oversight of decisions that affect compliance with applicable legal and regulatory matters and corporate policies. As part of the management oversight structure, the ERM team provides our Management Risk Committee with periodic updates on key risk conditions, strategy and mitigation efforts.


text: Our cybersecurity risk management process, which encompasses regular monitoring and periodic assessments, is designed to identify and mitigate cybersecurity threats and vulnerabilities. These efforts are aligned with the broader objectives of our ERM team and are regularly reviewed and refined in consultation with our Technology Risk Committee.


text: A key aspect of this integrated framework is the role of our Internal Audit team, which serves as an independent, objective assurance function tasked with evaluating the effectiveness of risk management, internal controls, and our governance processes.


text: Communication channels between our cybersecurity teams and other risk management personnel are established to facilitate the timely sharing of information about potential cyber threats. For example, our Data Protection and Information Security working group, which includes representation by our Chief Information Security Officer, and our Legal, ERM, Information Governance and Finance departments, among others, meets regularly to discuss key risks, strategies and threats related to information security.


text: Our Board of Directors administers a risk oversight function through its Audit Committee, and is supported by our ERM team, including on matters related to cybersecurity risks. This management reporting is designed to give our Board of Directors visibility over our operations and activities to adequately identify key risks, including among other things, cybersecurity risks, and understand management's risk mitigation strategies.


text: Our Cybersecurity department is staffed with professionals holding a variety of IT, cybersecurity and audit best practice certifications, including, among others, Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certified Cloud Security Professional (CCSP), International Organization for Standardization 27001 Lead Auditor Certification (ISO 27001 LA), Certified Information Privacy Professional (IAPP CIPP/CIPM), Alibaba Cloud's Cloud Security Certification (Ali-ACP), and Certified in Risk and Information Systems Control (CRSC). Our Cybersecurity department also has a training and development program in place so that appropriate skillsets are maintained and/or acquired, and professional certifications remain current.


text: Our cybersecurity teams are supported by training programs and a dedicated learning management system, Herbalife University, whereby all Herbalife employees receive mandatory security awareness training. Specialized training is also assigned to certain functions based on job responsibilities. Training content is purchased from multiple well-recognized third parties. In addition to assigned training, Herbalife University offers additional information security related courses available to all employees on demand.


text: Our cybersecurity program also engages a variety of consultants, auditors and other third parties to support and assist with implementing and maintaining appropriate security measures. Any number of third parties may be engaged to assist in response actions, including, among others, intelligence providers, product, software and service providers and advisors. Professional services, or consultants, are engaged as needed to help implement, support or advise on a variety of technical matters. Legal counsel, law enforcement and external auditors are also consulted as needed.


text: We have identified and, in some cases, engaged, third-party experts to allow for quicker engagement if a cybersecurity incident occurs in the future.


text: Risks from Cybersecurity Threats As of December 31, 2024 and as of the date of this filing, we are not aware of any risks from cybersecurity threats, including any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or nancial condition. This statement does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact.


text: We place the utmost importance on information security and privacy, including protecting the personal medical, financial and insurance information of our patients and employees. As part of a larger digital technology program, we have a cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ industry best practices across our operations and business functions, including through monitoring and assessing our threat environment; vulnerability assessments; detecting and responding to cyber-attacks, cybersecurity incidents, and data breaches; cybersecurity crisis preparedness and incident response plans; and investments in cybersecurity infrastructure and technology intended to reduce cybersecurity risk. Key aspects of our cybersecurity risk management program include the following: • adoption of the National Institute of Standards and Technology, or NIST, Cybersecurity Framework to assess the maturity of our cybersecurity programs; • periodic comprehensive cybersecurity program assessments conducted by an external cybersecurity consultant; • enterprise-wide security and privacy policies that are reviewed and updated annually; • information security and privacy training included in mandatory onboarding and annual compliance training for all personnel; • regular testing, both by internal and external resources, of information security defenses; • incident response procedures; • third-party cyber risk program to assess cybersecurity and information security risk associated with third parties that perform contracted services using information on our network; and • a security operations center that is designed to continuously monitor information on our network, investigate potential cyber threats and report on information security incidents.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: We engage consulting firms and other third parties in connection with our cybersecurity risk management processes. For example, third parties are engaged from time to time to conduct evaluations of our security controls, including penetration testing and independent audits, and to advise the Board of Directors, the Audit and Compliance Committee of the Board of Directors and/or our senior management team regarding cybersecurity matters.


text: We have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers. As part of these processes, we conduct cybersecurity due diligence where deemed advisable with respect to third-party service providers that will be accessing our information technology systems, including access to view or store sensitive data, prior to their engagement. Moreover, we have processes designed to oversee and identify material cybersecurity risks associated with the information systems of third-party service providers. In addition, third-party service providers that have access to our information technology systems, including access to view or store sensitive data, are contractually obligated to report cybersecurity incidents to us so that we can assess the impact of any such incident on our business.


text: The current cyber threat environment presents increased risk for all companies, particularly companies in our industry, as the volume and intensity of cybersecurity attacks on hospitals and health systems has continued to increase. We are regularly the target of cybersecurity attacks and other threats that could have a security impact, and we have experienced security incidents from time to time.


text: We do not believe that risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that materially affects us. For additional information regarding the risks to us associated with cybersecurity incidents, see "A cyber-attack or security breach could result in the compromise of our facilities, confidential data or critical data systems and give rise to potential harm to patients, remediation and other expenses, expose us to liability under HIPAA, privacy and data protection laws and regulations, consumer protection laws, common law or other theories, subject us to litigation and federal and state governmental inquiries and actions, damage our reputation, adversely impact our financial results and otherwise be disruptive to our business." included in Part I, Item 1A of this Form 10-K.


text: We maintain a cybersecurity insurance policy that provides coverage in connection with cybersecurity incidents. However, costs and damages associated with cybersecurity incidents may not be fully insured under our insurance policy, and (to the extent otherwise covered) are subject to applicable deductibles.


text: Our cybersecurity risk management processes are integrated into our overall risk management system. Our Board of Directors is responsible for the overall supervision of our risk management activities. The Board of Directors' oversight of the material risks faced by us occurs at both the full board level and at the committee level. In addition, the Audit and Compliance Committee has primary oversight responsibility regarding our information security, data security, data privacy, and other cybersecurity programs, procedures and risks. Further, the Audit and Compliance Committee and our Board of Directors receive updates at least quarterly from management, including our Chief Digital and Information Officer, or CDIO, covering our programs for managing cybersecurity risks, including data privacy and data protection risks. Additionally, the Audit and Compliance Committee and the Board of Directors actively participate in discussions with management and among themselves regarding cybersecurity risks.


text: Risk management is administered at a management level through a multi-disciplinary Enterprise Risk Committee comprised of members of management, including our CDIO. The Enterprise Risk Committee identifies and monitors what we believe to be the key risks currently facing the organization, including cybersecurity risks. A comprehensive presentation regarding our enterprise risk management process and our key risks is presented to the full Board of Directors on an annual basis.


text: In addition, we have established a Cyber Risk Executive Steering Committee, a multi-disciplinary management-level team chaired by our CDIO which is responsible for assessing and overseeing our information security and cybersecurity risk management policies, practices and priorities and for assessing and monitoring key cybersecurity risks with respect to reporting such risks within the organization.


text: At a management level, our cybersecurity risk management efforts are led by our Chief Information Security Officer, or CISO, who reports directly to the CDIO. Our current CISO was appointed as our Vice President and Chief Information Security Officer in 2024, and brings more than 25 years of experience in cybersecurity, technology and risk management. He has more than 15 years of experience in the healthcare industry, including his service with the Company since 2022. Prior to joining us, he served as Deputy Chief Information Security Officer at another large healthcare organization. Further, our CDIO has expertise in cybersecurity risk management through his more than 25 years of experience in cybersecurity, technology and data privacy roles, including his service as the Company's CISO from 2021 to 2024 and his service as CISO at another large organization prior to being employed by us. In addition to our CISO and CDIO, other individuals on our cybersecurity team have cybersecurity experience or certifications relevant to their respective role.


text: A key component of our enterprise risk management program is our incident response plan, which provides for controls and procedures in connection with cybersecurity incidents. Under this plan, we have established a cybersecurity incident command, a multi-disciplinary management-level team led by the CISO. The plan provides that the incident response team will conduct an initial assessment in the event of a cybersecurity incident meeting certain criteria elevated for the review of senior members of the cybersecurity team. In such event, the plan provides that the incident response team will assess whether a cybersecurity incident has the potential to materially impact the organization and whether public disclosure is required or advisable in connection therewith, and further provides that, if appropriate, any such cybersecurity incident may be further elevated for the review of senior management, the Audit and Compliance Committee and/or the Board of Directors.


text: Our Manager has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems and our critical information. Our Manager's cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: Our Manager uses the Center for Internet Security Critical Security Controls as a guide to help identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that our Manager meets any particular technical standards, specifications, or requirements.


text: Our Manager's cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to critical systems, information, services, and our Manager's broader enterprise information technology ("IT") environment; • a team comprised of IT and Legal & Compliance personnel of our Manager principally responsible for directing (1) the cybersecurity risk assessment processes, (2) our Manager's security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes or those of our Manager; • cybersecurity awareness training of employees with access to our Manager's IT systems; • a cybersecurity incident response plan; and • a third-party risk assessment process for key service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Operational risks, including the risk of cyberattacks, may disrupt our businesses, result in losses and limit our growth."


text: Our Board has generally delegated the cybersecurity risk oversight function to the Audit Committee. The Audit Committee monitors our Manager's design and implementation of its cybersecurity risk management program.


text: Our Manager's Director of Technology periodically reports to the Audit Committee and provides briefings on cybersecurity risks, our Manager's cyber risk management program, and, if applicable, known cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Audit Committee members also receive presentations on cybersecurity topics from our Manager's Director of Technology or external experts as part of our Board's continuing education on topics that impact public companies.


text: Our Manager's Director of Technology leads our Manager's overall cybersecurity function and supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including alerts and reports produced by security tools deployed in our Manager's IT environment.


text: Our Manager's Director of Technology is responsible for assessing and managing our Manager's material risks from cybersecurity threats and has primary responsibility for leading our Manager's overall cybersecurity risk management program and external IT cybersecurity service providers. Our Manager's Director of Technology has pertinent related experience in managing IT infrastructure and participates in various industry peer groups and organizations.


text: We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed yearly by our board of directors.

companyName: MEDICINOVA INC

ticker: MNOV


text: As of December 31, 2024, we have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees and contractors receive annual cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: Our Information Technology General Controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have utilized an outsourced information technology consultant to reduce and monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us, including prompt escalation and communication of major security incidents to senior business leadership and our board of directors.


text: Our board of directors is responsible for overseeing our cyber security risk management and strategy. Our senior leadership, including our Chief Executive Officer and Chief Financial Officer, regularly meets with and provides periodic briefings to our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors".


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, financial, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. Our cybersecurity program is informed in part by industry standards and best practices, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This program is managed and monitored by a dedicated information technology team, including a Senior Director of Information Security, and is led by our Senior Vice President, Chief Information Officer, or CIO. Our processes include mechanisms, controls, technologies, and systems designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. Our program includes, for example: • Regular penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments; • Engagement of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls as part of our operational security model; • Cybersecurity awareness training for our employees, contactors, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and annual tabletop exercises with participants from cross functional teams; • A third-party risk management process for service providers, suppliers, and vendors including due diligence prior to engagement and ongoing periodic review of our key technology vendors, and other contractors and suppliers.

companyName: Ultragenyx Pharmaceutical Inc.

ticker: RARE


text: Our CIO, together with our Senior Director of Information Security and other members of the IT leadership team, are responsible for assessing and managing cybersecurity risks. Our CIO has over ten years of experience managing information technology and cybersecurity. Our Senior Director of Information Security has over 25 years of experience managing information technology and cybersecurity matters and is certified as a Certified Information Systems Security Professional (CISSP). We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework.


text: Since the beginning of the last fiscal year, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our business and operations may be materially adversely affected in the event of computer system failures or security breaches."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our CIO. The Board also receives updates from the Audit Committee on cybersecurity risks on a regular basis.


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our product development and manufacturing, to communicate internally and externally, to operate our accounting and record-keeping functions, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Gentherm Inc

ticker: THRM


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of data privacy or security laws, litigation, and legal, financial and reputational risk.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems and our proprietary, strategic or competitive data. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program and employee training. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We have an incident response process that relies on a multidisciplinary team for assessing and managing cybersecurity incidents, including an escalation framework based on the materiality of incidents. The multidisciplinary team includes members of our IT security function, executive management of our legal, finance, human resources, corporate communications and internal audit/risk functions and third party service providers of technical, legal and insurance services, as well as coordination with law enforcement as appropriate. Our IT security function also addresses cybersecurity threats through regular vulnerability reviews, risk registry reviews and global team meetings.


text: Our information security processes are integrated into our overall enterprise risk management ("ERM") process and system. Our ERM process relies on designated risk managers to identify and assess material risks from cybersecurity threats. The risk managers form a multidisciplinary group including members of our IT security, finance, human resources and legal functions, operations and executive management, and are responsible for timely reporting of risks on an ongoing basis. Our ERM process includes an annual evaluation and ranking of the top risks captured in our ERM system against leading third party benchmark reports on global risks.


text: We work with third parties from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms.


text: To operate our business, we utilize certain third-party service providers to support a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: Our systems periodically experience directed attacks that may be intended to lead to financial loss, interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and other stakeholders) and other data, confidential information or intellectual property. These attacks are increasing in frequency, uniqueness and sophistication to evade detection and remove forensic evidence of the incident, including due to emerging technologies such as artificial intelligence and machine learning, which may cause cybersecurity incidents to be more difficult to detect for periods of time or at all. However, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional discussion about cybersecurity-related risks.


text: Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees the quality and effectiveness of the control and enterprise risk management processes of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee receives reports and engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and reasonably manage these risks, including those that may result from material cybersecurity threats. The Audit Committee also receives reports on material cybersecurity and data privacy incidents (if any), which would include plans to mitigate and respond to such incidents, and status on key information security initiatives. These discussions include the Company's enterprise risk assessment and risk management policies.


text: The Technology Committee of the Board of Directors oversees the management of risks associated with the Company's products and technologies, including cybersecurity risks related to new product technologies or significant innovations to existing product technologies, in accordance with its charter.


text: Our Vice President & Chief Information Officer (the "CIO") leads our global information security organization and reports to the Board of Directors on matters related to cybersecurity on behalf of the Company's management. Our CIO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large industrial and technology companies.


text: Our CIO leads an internal IT Security Committee that meets regularly to oversee company-wide efforts to address cybersecurity threats, to assess the effectiveness of our information security program and to prioritize efforts to improve our security measures and planning. Our IT Security Committee includes members of our IT security function and executive management of our legal, finance and internal audit/risk, human resources and corporate communications and technology functions.


text: Risk Management and Strategy City Office REIT recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: City Office REIT, Inc.


text: The Company has integrated cybersecurity risk management into our overall risk assessment framework to identify, evaluate and manage cybersecurity threats and risks. Our CFO works closely with our IT service provider and internal auditors to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with internal auditors and a range of external experts, including cybersecurity assessors and consultants, in evaluating and testing our systems and security processes. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes reviews of cybersecurity-related processes and controls in line with current international cybersecurity standards to evaluate the maturity and risks of our current cybersecurity program and consults on security enhancements. The Company further collaborates with these third-parties to conduct threat assessments, penetration testing and social engineering testing to assess the Company's systems, applications and personnel education and awareness regarding cybersecurity threats. As we are aware of the risks associated with third-party service providers, the Company maintains ongoing monitoring to ensure compliance with our service level requirements.


text: We do not believe that our Company, including our business strategy, results of operations, or financial condition, have been materially affected by any cybersecurity incidents for the reporting period covered by this Annual Report on Form 10-K. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems."


text: The Board of Directors and Audit Committee are acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Audit Committee is composed of Board members with diverse expertise, including in risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain.


text: The CFO and CEO play a pivotal role in informing the Audit Committee on cybersecurity risks. The CFO regularly informs the CEO of all aspects related to cybersecurity risks and incidents ensuring the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. They provide briefings to the Audit Committee as needed, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: While we have not had any material cybersecurity breaches to our knowledge, the CFO is continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The CFO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security measures and system audits as needed to identify potential vulnerabilities. In the event of a cybersecurity incident, the CFO is equipped with an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. As part of this program, we have processes in place that are designed to assess, identify and manage material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management process and have been embedded in the Company's operating procedures, internal controls and information systems.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") 800-53, including derivatives such as NIST Cybersecurity Framework ("CSF") and HITRUST, as well as NIST 800-66 and the Center for Internet Security ("CIS"). Recently we have obtained HITRUST certification for one of our core clinical applications, however this does not mean that overall we meet any particular technical standards, specifications, or requirements, but only that we use these standards as a guide to help us design and assess our program.


text: We rely on a multidisciplinary team, including our information security organization, legal department, management, and third-party service providers, as described further below, to assess, identify, and manage cybersecurity threats and risks.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment, including monitoring and evaluating our threat environment and our risk profile; • a security governance council principally responsible for management's oversight of our IT security; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; • a third-party risk management process for service providers, suppliers and vendors covering compliance and technical controls; • cybersecurity awareness training for our employees, incident response personnel and senior management; and • a cybersecurity incident response plan with established procedures for assessing and responding to cybersecurity incidents, and that includes having an experienced incident response firm on retainer.


text: For information on the Company's cybersecurity-related risks, see "Information Systems, Cybersecurity and Data Privacy Risks" in Item 1A. Risk Factors in this Form 10-K. While to date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, the sophistication of cybersecurity threats continues to increase, and the preventive actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. Our Board of Directors has elected to exercise direct oversight over this area, rather than acting through one of its committees, given the increasing importance of cybersecurity matters and the cross-functional impacts of technology on our business. Our Board of Directors receives reports at least twice per year from members of senior management, including our Chief Information Security Officer ("CISO") and Chief Compliance Officer, regarding the Company's information systems and technology and associated policies, processes, and practices for managing and mitigating cybersecurity and technology-related risks. Our Board of Directors also meets with external advisors to discuss technology and cybersecurity risks applicable to the Company and obtains perspectives which inform senior management's discussions with our Board of Directors. Our Board of Directors has delegated oversight of the process for determining disclosure required with respect to cybersecurity incidents to its Audit Committee.


text: At the management level, our information security organization is led by our CISO, who is responsible for cybersecurity risk management, with oversight by our Board of Directors. Our CISO has more than 20 years of experience in information security and IT risk management. He has specific experience in the following information security areas: security governance and policy, information security strategy and planning, penetration testing, vulnerability management, cybersecurity threat intelligence, incident response, third party risk management, cloud security, application security, identity and access management, data loss prevention, and security awareness.


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security organization, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional ("CISSP"), Certified Data Privacy Solutions Engineer ("CDPSE"), or Security+ and through the use of technological tools and software and results from third-party audits. Our cybersecurity incident response framework is governed by a cybersecurity incident response plan, which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. We have an incident response team comprised of our CISO, executive leaders, management and internal and external legal counsel, whose primary responsibilities include: • Evaluating and validating the impact of an incident; • Approving certain incident response countermeasures and remediation actions; • Escalating incidents and response countermeasures for approval; and • Acting in an advisory capacity in support of cybersecurity incident remediation, as appropriate.


text: We have also established a security governance council (the "Council") to further strengthen our cybersecurity risk management activities across the Company. The Council includes our Chief Executive Officer, Executive Vice President, Chief Financial Officer and Treasurer, Executive Vice President, General Counsel, Chief Administrative Officer and Secretary, Senior Vice President, Operations, Senior Vice President and Chief Information Officer, Senior Vice President, People Services, Vice President and Chief Information Security Officer, Vice President, Chief Compliance Officer, and Associate Vice President, Internal Audit. The Council meets quarterly and is responsible for management's oversight of our IT security in a cohesive and holistic manner that is designed to enable optimal decision-making.


text: In an era marked by rapid technological evolution, the business landscape is increasingly data-driven. Companies, including ours, collect, store, and leverage data to glean valuable insights about our members and travel trends; deliver relevant content to our members, suppliers, and business partners and enhance operational efficiency. This collection and leverage of data exposes us to potential cybersecurity threats. Our cybersecurity program is guided by industry standards developed by the National Institute of Standards and Technology ("NIST"). As a result, we have implemented a cybersecurity risk management framework that is designed to identify, assess, and mitigate risks from cybersecurity threats to our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the data residing on those systems. While no organization can eliminate cybersecurity risk entirely, we believe our cybersecurity program is reasonably designed to mitigate our cybersecurity and information technology risks.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Oversight and Governance The Board of Directors is responsible for overseeing management's processes for managing cybersecurity risks and has delegated this function to the Audit Committee. The Audit Committee regularly reviews and discusses with management the processes to identify, assess and manage cybersecurity threats, as well as to identify, assess and, to the extent required, disclose whether risks from cybersecurity threats have materially affected the Company or if material cybersecurity incidents have occurred.


text: Management is responsible for the day-to-day risk management process, including the identification of risks and implementation of policies and procedures designed to manage, mitigate or monitor cyber risks. In support of these responsibilities, management has formed a Compliance Committee and designated a Chief Compliance Officer to implement, manage and oversee a corporate compliance program.


text: The Compliance Committee is responsible for understanding the global risk landscape of the Company and for working to ensure that we have a compliance program in place designed to mitigate, manage and/or monitor risks. The Compliance Committee consists of, among others, our Chief Financial Officer ("CFO"), Chief Legal Officer ("CLO") and Chief Compliance Officer ("CCO"). The CCO has established an Information Governance and Privacy Committee responsible for oversight of privacy and cybersecurity risks. The Information Governance and Privacy Committee consists of senior members of the Company's Information Security Team and CCO, as well as representatives from engineering, product development and data privacy. The Information Governance and Privacy Committee meets regularly to discuss and monitor information uses and governance and risks associated with our information assets, including prevention, detection, mitigation and remediation of risks from cybersecurity threats.


text: Our Information Security Team reports to our CCO. The CCO reports to the Compliance Committee, which includes the CFO and CLO. The CFO and CLO report directly to the Company's Chief Executive Officer. Each of the CFO, CLO and CCO report regularly to our Board of Directors on, among other matters, our global risk landscape and risk management efforts, including those related to cybersecurity risks.


text: Our CCO, supported by our Information Security Team, has primary responsibility for managing our cybersecurity threat management program. We maintain rigorous standards for our information security leadership positions, including requiring extensive experience in building and leading cybersecurity security teams and implementing enterprise-wide cybersecurity programs. Our CCO and Information Security Team continue to execute on our established cybersecurity strategy and risk management framework.


text: The CCO, with input from the Information Security Team, meets regularly with and provides updates on cybersecurity developments to, members of the executive management team.


text: Our Information Security Team meets at least annually with each of the Compliance Committee and the Audit Committee to discuss cybersecurity threats and the risk management programs. The Information Security Team provides information, as appropriate, about the sources and nature of risks the Company faces and how management assesses such risks. Our CCO also provides a quarterly report to the Audit Committee on trends and observations concerning cyber threats and actions being taken to mitigate those risks. The Chair of the Audit Committee reports quarterly to the full Board of Directors and that report includes a summary of the CCO's report.


text: Processes for the Identification of Risks from Cybersecurity Threats The Compliance Committee, working with the Information Security Team, has developed a cybersecurity risk management program that aims to address the following key areas: • Identification of assets at risk from cybersecurity threats; • Identification of potential sources of cybersecurity threats; • Assessment of the status of protections in place to prevent or mitigate cybersecurity threats; • Approaches to mitigating and managing cybersecurity risks; and • A process for regular reporting to the Compliance Committee and Board of Directors (directly and through the Audit Committee).


text: The Company's risk assessment and mitigation program is centered on the following components: • Identification of significant risks (primarily through enterprise risk assessments); • An evaluation of the likelihood of such risk occurring, the potential impact and the control strength, consideration for compensating controls to mitigate the risk; • Prioritization of different risk items based on, among other things, the results of our evaluation; and • Establishment of a process for addressing those risks.


text: Our Internal Audit team reviews, monitors and audits various aspects of the Company's enterprise risk management program to evaluate whether risks, including cybersecurity risks, are appropriately identified and managed. Internal Audit periodically reports to the Audit Committee on the Company's cybersecurity risk mitigation efforts. The Audit Committee Chair, in turn, reports to the full Board of Directors.


text: Our Incident Response Plan ("IRP") is designed to facilitate rapid incident response to any security incident affecting the Company's business lines, locations, services, and divisions. The IRP defines the roles and responsibilities for the senior leadership team and cybersecurity experts to identify and respond to cybersecurity events and incidents while complying with legal obligations. The Incident Response Team ("IRT") is designated by the IRP to assess each cybersecurity incident and event for impacts to the Company, customers, and third-party partners and oversee the response to and remediation of such incident.


text: We have several employee training and development programs that are designed to, among others, raise awareness of cybersecurity risks impacting the business to encourage consideration and facilitate managing those risks. To assess the effectiveness of our program, we periodically conduct penetration testing and other vulnerability analyses. As part of the assessment of the protections we have in place to mitigate risks, we engage third parties to conduct risk assessments on our systems.


text: We rely on certain third-party computer systems and third-party service providers in connection with providing some of our services. These third-party business partners, service providers, and consultants need to access our customer and other data, and connect to our computer networks. We define expected security and privacy requirements through our contracting processes with those third parties and we perform cyber risk assessments at the time of procurement to review the cyber risk management efforts of those third parties. These vendors are contractually obligated to notify us when they experience a cybersecurity incident that can affect our operations or stakeholders.


text: Before purchasing third-party technology or other solutions and partnerships that involve exposure to the Company's assets and electronic information, our Information Security and Privacy team undertakes due diligence to assess any key data privacy or information security risks.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and cybersecurity incidents relating to our information technology systems and infrastructure. Our third-party vendors may also experience threats and cybersecurity incidents from time to time.


text: For additional information about the cybersecurity risks, see "Risk Factors" under the section entitled "Risks Related to Information Security, Cybersecurity and Data Privacy" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Partnership management considers risks from cybersecurity threats as a component of its entity-wide risk assessment that includes various processes and procedures to assess, identify, and manage material risks. The Partnership uses a variety of information technology solutions in the operation of its business, all of which are maintained by reputable third-party providers, including an information technology managed services system provider that is an affiliate of Greystone.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: Management regularly communicates with the Greystone affiliate regarding the information technology managed services system including ongoing threats or cybersecurity incidents, monitoring of third-party vendors used by the Greystone affiliate, and review of System and Organization Controls assurance reports. Risk management processes in place at the Greystone affiliate include an annual cybersecurity risk assessment, third-party network security assessments, continuous employee training, regular internal information technology audits, and ongoing threat monitoring.


text: Management regularly reviews material technology services used, the population of technology service providers, and material and/or sensitive financial and operational data, and then assesses the material risks from cybersecurity threats associated with these items. Management has developed processes, procedures, and internal controls to address materials risks focusing on application security (levels of access, passwords, etc.), system change controls, and operations processing. The design and operating effectiveness of internal controls are subject to testing annually by the Partnership's internal audit function.


text: Management has also developed procedures to assess the operations and internal controls of material service providers through questionnaires, inquiries, reviews of available policy statements, and evaluation of System and Organization Controls assurance reports, which are assessed in the aggregate to determine if the service providers have adequately addressed the risks of cybersecurity threats within their operations. The overall assessment includes an evaluation of a service provider's breach notification policies and procedures and any reported cybersecurity incidents. Management is not aware of any cybersecurity incidents at any of its service providers that have materially affected or are reasonably likely to materially affect the Partnership's operations.


text: Notwithstanding the extensive approach the Partnership takes to cybersecurity in conjunction with Greystone, the Partnership may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Partnership. See "Item 1A. Risk Factors," for a discussion of cybersecurity risks.


text: Certain employees of Greystone Manager that provide services to the Partnership are responsible for assessing and managing material risks from cybersecurity threats and are overseen by the Partnership's Chief Financial Officer. The Chief Financial Officer and relevant Greystone Manager employees collectively have over 20 years of experience in information technology risk assessment and audit evaluations. These individuals will also consult with experts from Greystone's affiliate that provides information technology managed services systems, particularly the Chief Information Security Officer of the Greystone affiliate, when assessing and evaluating risks of cybersecurity threats. These consultations with the Chief Information Security Officer typically encompass a broad range of topics, including the current cybersecurity landscape and emerging threats; the status of ongoing cybersecurity initiatives and strategies; incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards. The Greystone affiliate's Chief Information Security officer and Information Security Committee (made up of key information technology personnel) are responsible for establishing, maintaining, and monitoring the cybersecurity ecosystem at the Greystone affiliate. The Chief Information Security Officer and Information Security Committee together have over 25 years of experience in information technology managed services systems and cybersecurity.


text: The Partnership has established incident response procedures to be followed in the event of a cybersecurity incident that is overseen by the Partnership's Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and the Chief Financial Officer are notified of cybersecurity incidents as soon as the Partnership receives notification from a third-party service provider or is informed by other means, and will determine if additional internal and/or external resources are needed to evaluate, mitigate, and remediate the cybersecurity incident. At a minimum, the Board of Managers will be notified of material cybersecurity incidents prior to any public announcement and will receive updates on material developments and remediation activities.


text: The Board of Managers considers risks from cybersecurity threats in conducting its oversight of the Partnership's overall risk assessment, primarily through the activities of the Audit Committee of the Board of Managers. The Chief Financial Officer reports to the Audit Committee the results of the evaluation of risks from cybersecurity threats, the process, procedures and internal controls designed to address such risks, and other relevant information needed for the Audit Committee to operate its oversight responsibilities. The Partnership's internal audit function reports to the Audit Committee annually the results of its assessment of design and operating effectiveness testing of internal controls. In addition, the Audit Committee conducts an annual review of the Partnership's cybersecurity posture and the effectiveness of its risk management strategies. This review assists in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework of the Partnership.


text: Additional third parties, contracted with by our third-party service providers, also play a role in the Partnership's overall cybersecurity. Our third-party service providers engage with a range of additional third-party service providers and external experts, including cybersecurity assessors, consultants, and auditors, to evaluate and test their risk management systems. These services include, but are not limited to, penetration testing, independent audits, and consulting on best practices to address new challenges, and also include testing both the design and operational effectiveness of our security controls. These engagements enable our service providers to leverage specialized knowledge and insights, ensuring cybersecurity strategies and processes remain at the forefront of industry best practices.


text: Risks from Cybersecurity Incidents The Partnership has not encountered, to its knowledge, a cybersecurity incident that has materially impaired, or is reasonably likely to materially impair, our business strategy, operations, or financial condition. There can be no assurance that such effects may not occur in the future.


text: Autoliv maintains a cybersecurity program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats as an integrated part of the Company's overall operations. The objective is to provide protection against cybersecurity threats to our employees, operations, data, and products.

companyName: AUTOLIV INC

ticker: ALV


text: Cybersecurity risk management for the Company is undertaken both through dedicated cybersecurity risk management processes and within the Company's overall Enterprise Risk Management program, which is overseen by the Audit and Risk Committee of the Company's Board of Directors.


text: Autoliv has established an Enterprise Risk Management framework aligned to the ISO 31000:2019 to ensure that the context, principles, and processes for risk management are embedded and integrated with the operations of the company. All risks across the Autoliv risk universe, including cybersecurity, are assessed with bottom-up risk assessments and subsequently are aggregated and reported to the Audit and Risk Committee of the Company's Board of Directors.


text: Autoliv utilizes the National Institute of Standards and Technology ("NIST") Cybersecurity Framework in combination with other corresponding and partially mandated frameworks to guide cybersecurity risk management. This approach includes the identification, assessment, response, and management of risks arising from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our business, data and information systems. The Company contracts with third parties to assess Autoliv's cybersecurity program relative to its peers, utilizing the NIST framework as a baseline. Furthermore, Autoliv is pursuing, under TISAX (Trusted Information Security Assessment Exchange), an assessment and exchange mechanism for information security in the automotive industry, as well as compliance with road vehicle cybersecurity requirements as applicable to the supply chain under ISO 21434.


text: Frequent testing/auditing activities, bottom-up cybersecurity risk assessments, vulnerability scanning, monitoring of external threat intelligence and supplier risk sources, and 24/7 incident monitoring are executed by the cybersecurity function to inform our understanding of the cybersecurity risk landscape, including solutions from third-party service providers, and what areas of enhancement to prioritize. Further input is gained from regular maturity assessments executed by third parties as well as TISAX assessments executed by external audit bodies.


text: Autoliv combines expertise from our internal cybersecurity function with additional specialist capacities from external consultants and partners as may be from time to time. Separately, because we understand the risks associated with engaging third party vendors, such as service providers, consultants and partners, in our cybersecurity risk management processes, we conduct security assessments pre-engagement and monitor their work to mitigate any identified risks.


text: Autoliv has not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with or effective in protecting our systems and information. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. For a full discussion of these cybersecurity risks, please see our Risk Factors in Item 1A.


text: The Chief Information Security Officer (CISO) is responsible for overseeing the Company's cybersecurity practices. Our CISO joined Autoliv in 2015. He has 30 years of information technology experience, including seven years as CISO. The CISO reports directly to the CFO but, in line with the corporate governance model, the CISO's activities are formally governed through a management board, the "Digitalization and IT Management Board" ("DITM Board") comprised of the Chief Information Officer (CIO) and certain members of Autoliv's Executive Management Team ("EMT") representing engineering, supply chain management, operations and manufacturing, quality and project management, finance, information technology, and divisional teams. The DITM Board meets at least quarterly with cybersecurity as a standing agenda item. In addition to the standing DITM Board meetings, the CISO, when needs arise, meets with the full EMT typically at least semi-annually to report on, or discuss, specific cybersecurity-related topics.


text: The Cybersecurity function in Autoliv reports to the CISO. The cybersecurity function includes team members in all of the Company's divisions including technical security architects and incident response team members. The core team is supported by the broader organization with security coordinators in each plant and tech center and additional functional security experts as deemed relevant, such as in supply chain management and engineering. The function has the responsibility to operate day-to-day activities (e.g., testing, incident monitoring and response, vulnerability scanning and awareness training) as well as to drive prioritized improvements (as identified through the risk management processes), together with other relevant Autoliv functions and stakeholders. The security operations center ("SOC"), part of the Cybersecurity function, monitors Autoliv for cyber incidents 24/7. A documented incident response process and numerous documented playbooks provide the SOC guidance on how to respond for each type of incident, including categorization and principles for escalation. Incidents are escalated in the organization according to defined criteria to engage a level of authority that is deemed appropriate, such as the Corporate Crisis Management Team if necessary.


text: Our Board, in coordination with the Audit and Risk Committee, oversees the Company's Enterprise Risk Management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit and Risk Committee. Both the Board and the Audit and Risk Committee periodically review the measures we have implemented to identify and mitigate cybersecurity risks.


text: The Audit and Risk Committee receives information from the CISO and other members of management on at least a quarterly basis which is supplemented by a more extensive briefing from the CISO and management on at least a semi-annual basis on cybersecurity matters, including updates on cybersecurity training programs and the results of external assessments, as applicable. The CISO provides at least an annual briefing to the Board of Directors on these same topics.


text: The routine reporting to the Audit and Risk Committee and the Board includes as appropriate the highlights from the full spectrum of work done within the Company's cybersecurity program. The briefings by the CISO to the Audit and Risk Committee and Board also include the review of certifications and cybersecurity maturity assessments by management and third parties.


text: The Company maintains robust and comprehensive processes, procedures and controls to protect and secure its information systems and data infrastructure from cybersecurity threats. The Company's cybersecurity program is led by its Chief Information Security Officer ("CISO"). The Company's cybersecurity program interfaces with other functional areas within the Company, including but not limited to the Company's business segments and information technology, legal, risk management, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate the Company's employees regarding cybersecurity. The CISO also manages the Company's Security Incident Response Plan (the "Incident Response Plan"), which outlines action steps for the preparation, identification, triage, analysis, containment, eradication, recovery and reflection stages of a cybersecurity incident. The Incident Response Plan serves as the charter for the Company's Security Incident Response Team (the "Incident Response Team"), which includes a strategic team comprised of executives from various cross-functional management teams, as well as a tactical team comprised of internal technical support roles and external third-party service providers. The Incident Response Plan provides how the Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on type and severity of the specific incident.


text: The Company also requires cybersecurity training for all active employees, focusing on the appropriate protection and security of confidential company and third-party information. Additionally, the Company provides quarterly cybersecurity awareness training that covers a broad range of security topics, including secure access practice, phishing schemes, remote work and response to suspicious activities. In addition to online training, employees are educated through several methods, including event-triggered awareness campaigns, recognition programs, security presentations, company intranet articles, videos, system-generated communications, email publications and various simulation exercises.


text: The Company has engage d a third-party managed detection and response company to monitor the security of its information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. The Company also maintains a cybersecurity insurance policy and has engaged a third-party digital forensics and incident response consultant and legal counsel on retainer.


text: The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: The Company's Audit Committee and board of directors provide ultimate oversight of the Company's cybersecurity risk management. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The Company's CISO and Chief Information Officer ("CIO") provide quarterly reports to the Audit Committee regarding the evolving cybersecurity risk landscape, including emerging risks, as well as the Company's processes, program and initiatives for managing these risks.