text: Our Director of Information Technology has more than 20 years' experience in financial services, substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information technology department and developing and implementing our cybersecurity and information security programs. These qualifications, certifications, and experience include a degree from the University of California, Santa Barbara with focus on Business Administration coursework, Certified Information Systems Security Professional from ISC2 Organization.


text: Cybersecurity is one of the cornerstones of our strategic business plan and the driving force behind our digital transformation journey. As a financial institution, we confront a spectrum of cyber threats, ranging from common attacks like ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners, emphasizing the critical need for a robust cybersecurity stance. In light of these challenges, maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and the maintenance of customer confidence in our banking services.

companyName: BayCom Corp

ticker: BCML

secItem: Item 1C


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk appetite with our strategic objectives. Our enterprise risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Director of Information Technology leads our cybersecurity program, reporting directly to the Chief Operating Officer ("COO") and provides reports and updates to the Audit Committee, the Enterprise Risk Committee and the Chief Risk Officer ("CRO") quarterly or more frequently as required.


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our Information Security Program aligns with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool, and is periodically reviewed and updated at least annually or more frequently upon significant changes to our operating environment. Our Information Security Program is led by our Information Security Officer in conjunction with our Director of Information Technology.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The IRP is coordinated through the Director of Information Technology, COO, CRO, and key members of management and addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements.


text: We rely on a series of processes to identify threats, hazards, and other risks to our information assets. We employ a variety of preventative and detective tools from our Managed Security Services provider designed to monitor, detect, block, and alert us to suspicious and unauthorized activity, including suspected advanced persistent threats. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, which integrate directly into our patch and vulnerability management tools.


text: We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems, and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including our information security program, to assess their design and operating effectiveness. We provide regular and ongoing security education and training for employees and conduct recovery and resilience tests.


text: The Company maintains a cyber insurance policy as part of its overall risk management strategy to mitigate financial losses in the event of a cybersecurity incident. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis. All risk and security assessment results are shared with the Board of Directors.


text: Our assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our Information Technology teams meet to ensure that risks are timely identified, patch and vulnerability requirements are monitored, and the necessary changes are implemented.


text: Our Information Technology Governance ensures alignment between the Bank's technological strategy and business goals. We strive for efficient utilization of IT resources while effectively managing IT risks within the Bank's risk appetite. Additionally, our robust Vendor Management Program ensures proper oversight during the onboarding of new products, projects, and third-party vendors.


text: Identified Cybersecurity Risks Federal and state regulators have issued guidance requiring financial institutions to implement layered security controls, strengthen client authentication for online services, and address risks from compromised credentials. Institutions must also maintain business continuity plans to ensure timely recovery of operations and data following a cyber-attack. Failure to comply with these regulations may result in sanctions, including financial penalties.


text: State regulators have increasingly enacted cybersecurity laws, including requirements for cybersecurity programs, data encryption, and breach notification. Many states have recently updated their data privacy regulations, and we expect this trend to continue. We actively monitor legislative and regulatory developments to ensure compliance.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct operations and store and transmit sensitive data. We employ a layered cybersecurity approach, leveraging people, processes, and technology to monitor, detect, and mitigate threats. Our defenses include a variety of preventative and detective tools designed to block unauthorized activity and identify advanced persistent threats. Despite these measures, cyber-attacks are increasingly sophisticated and frequent, particularly in the financial services sector. While we have not experienced a material cybersecurity incident to date, a significant breach could result in financial losses, operational disruptions, reputational harm, regulatory scrutiny, or legal liability. In addition to securing our own systems, we rely on third-party service providers for various critical functions, including payment processing, cloud storage, and cybersecurity tools. Our systems, as well as those of our clients and third-party vendors, remain under constant threat, and vulnerabilities within these external providers could also pose risks to our operations.


text: Given the evolving nature of cyber threats and the expanding use of online banking and digital services, our risk exposure is expected to remain high. We continuously assess and monitor cybersecurity threats in real time, including risks associated with third-party providers, to enhance our security posture. However, there can be no assurance that our cybersecurity risk management program will fully protect the confidentiality, integrity, and availability of our information systems and solutions. See "Risks Related to Cybersecurity, Third Parties and Technology" under "Item 1A. Risk Factors" in this Form 10-K for further discussion of risks related to cybersecurity.


text: Management and Board Oversight of Cybersecurity Risks Our Cybersecurity Program is managed by our Director of Information Technology, who leads our Information Technology team responsible for implementing our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Information Technology provides periodic reports to the executive risk management committee, the board-level risk committees of the Company and the Bank and the Chief Executive Officer and other members of our senior management, as well as the cross-functional management team that oversees the information security and information technology programs. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents.


text: The Board receives formal cybersecurity updates at least quarterly from the Director of Information Technology, the Chief Operating Officer, and the Chief Risk Officer. These reports include updates on emerging threats, incident response activities, regulatory developments, and enhancements to cybersecurity frameworks. Additionally, the Board periodically conducts cybersecurity resilience reviews, including scenario planning and tabletop exercises, to evaluate preparedness for potential cyber incidents. The Chief Operating Officer, Chief Risk Officer, and board-level risk committees of the Bank also provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.


text: Our Director of Information Technology has more than 20 years' experience in financial services, substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information technology department and developing and implementing our cybersecurity and information security programs. These qualifications, certifications, and experience include a degree from the University of California, Santa Barbara with a focus on business administration coursework and a Certified Information Systems Security Professional designation from ISC2 Organization.


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").

companyName: Forza X1, Inc.


text: We have undertaken, on an annual basis, to conduct an assessment of our cyber risk management processes and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We consult with a third-party specialist with regard to our cyber risk management processes and controls.


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on Forza's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Forza acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have undertaken, on an annual basis, to conduct an assessment of our cyber risk management processes and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Twin Vee PowerCats, Co.

ticker: VEEE


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: BioCrude utilizes the specialized services of an IT professional, to protect its internet-connected systems, such as hardware, software and data from unauthorized access to its data centers and other computerized systems. We deploy collective methods, technologies, and processes to help protect the confidentiality, integrity, and availability of computer systems, networks and data. Part and parcel of our cybersecurity is, continuously updating our licensed/purchased software, running up-to-date antivirus software, having firewalls (Secure for BioCrude's website provided by its website hosting agent, and Watchguard systems as a gatekeeper to the internet), as well as being prudent on continuously changing usernames and passwords and being cognizant and suspicious of unexpected emails (Phishing emails are currently one of the most prevalent risks to the average user).

companyName: BioCrude Technologies USA, Inc.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: SPLASH BEVERAGE GROUP, INC.

ticker: SBEV


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the President who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our President. Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, and Chief Financial Officer. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents including significant breaches to the Company's networks or systems. The audit committee receives regular reports from the information technology team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity and Data Privacy Risks We are subject to cybersecurity and data privacy risks. Cyberattacks and security vulnerabilities could lead to increased costs, liability claims, or harm to our competitive position.

companyName: Bannix Acquisition Corp.


text: Cybersecurity Risks Our operations and the operations of our and partners involve the storage, transmission, and processing of third parties' and our data, including personal, confidential, or proprietary information. This data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety of methods to exploit potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized access, loss, misuse, disclosure, modification, or destruction of this data.


text: We are committed to protecting our third parties' and our data. Despite efforts, our systems, products, and services remain vulnerable to attacks.


text: Data privacy issues are becoming increasingly significant due to the rapidly changing legal and regulatory landscape. Compliance with global and local data privacy laws requires ongoing investment in our information technology and employee training, and will continue to impact our business.


text: We should have a formal risk management program that addresses cybersecurity and data privacy risks. This program should include regular reporting to our senior management and Board of Directors, who provide oversight and direction. We have not established an enterprise risk management framework to assess and prioritize these risks.


text: We maintain an incident response plan that includes policies and procedures for notifying affected third parties and complying with applicable laws.


text: Investments in Cybersecurity We will continually invest in our cybersecurity capabilities to protect our assets and those of our third parties. This potentially will include investment in advanced threat detection, encryption, and other security measures. Recent Cybersecurity Incidents During the last fiscal year, we did not experienced cybersecurity incidents.


text: At this time, the Company does not have formal processes in place for assessing, identifying, and managing material risks from cybersecurity threats. Our approach to cybersecurity is currently informal and primarily reactive, involving basic security measures such as: Basic Security Software: We use standard antivirus and anti-malware software for protection against common threats. Policies: Simple password policies are in place to protect access to our systems.

companyName: Global Innovative Platforms Inc.

ticker: GIPL


text: However, we recognize the importance of cybersecurity and are in the process of developing more robust strategies. We plan to: Develop a Cybersecurity Framework: Establish a formal risk assessment process to identify vulnerabilities. Cybersecurity Expertise: Consider hiring or consulting with cybersecurity professionals to guide our strategy. Training: Begin employee training on cybersecurity awareness to prevent common threats like phishing.


text: We acknowledge that the absence of comprehensive cybersecurity processes could potentially expose the company to risks, which might materially affect our operations, financial condition, or strategic decisions in the future. We are committed to improving our cybersecurity posture as our resources allow.


text: Currently, our sole director does not have a formal structure for overseeing cybersecurity risks. We plan to review this oversight in the near future to ensure appropriate governance is established.


text: Role: Day-to-day management of cybersecurity is handled by our IT staff, who do not have specialized training in cybersecurity. We are considering enhancing this role or outsourcing to professionals with specific cybersecurity expertise.


text: Our current management and Board do not have in-depth cybersecurity expertise. We are considering educational opportunities or consulting to address this gap.


text: from Cybersecurity Threats To date, no known cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, due to our limited cybersecurity measures, we acknowledge that our company could be at higher risk of material impact from cybersecurity threats. We are actively working to mitigate these risks.


text: Our company recognizes the critical importance of cybersecurity in our digital operations and has established a risk management program to address both internal and external cybersecurity threats. We acknowledge the challenges posed by the evolving nature of cyber threats and the limitations in fully mitigating these risks.

companyName: Kaival Brands Innovations Group, Inc.

ticker: KAVL


text: We have not observed any significant impacts from known cybersecurity threats or previous incidents on our operational, strategic, or financial aspects. Nevertheless, given the unpredictable nature of cyber threats, we cannot assure complete immunity against potential future impacts.


text: The likelihood of cybersecurity incidents is influenced by frequency risk factors. External factors include market trends in cybercrime, technological advancements in hacking methods, and geopolitical developments. Internal factors are shaped by our policies, the effectiveness of employee training, and robustness of system updates and maintenance procedures. External cybersecurity incidents events may include and are not limited to service disruptions due to email borne threat activities, ransomware, or denial of service attacks against us or our suppliers, while internal events may comprise of internal threats, subcontractors, or governance failures among other events.


text: Cybersecurity incident response plans are regularly updated to include structured processes encompassing identification, containment, eradication, recovery, and post-incident review. Continuous monitoring of systems and networks allows for the detection and response to potential cybersecurity threats. Response capabilities are regularly reviewed to align with the evolving cyber threat landscape and processes are fully integrated into our broader risk management system.


text: Criteria used to determine the materiality of an incident includes, but is not limited to, evaluating the scope, nature, type, systems, data, operational impact, and pervasiveness of the incident.


text: This approach involves continuous oversight and improvement based on evolving cyber threats. Materiality also considers both quantitative and qualitative factors in determining impact.


text: Third-party engagement processes include risk evaluation across various domains such as cybersecurity, data privacy, supply chain, and regulatory compliance. We are committed to transparently disclosing material and unauthorized cybersecurity incidents involving third-party service providers, considering factors like operational technology system damages, information breaches, and interconnected attacks exploiting vulnerabilities.


text: Our Board of Directors plays a pivotal role in overseeing the organization's preparedness for cyber threats. This involves a comprehensive understanding of our risk profile and ensuring appropriate cybersecurity controls are in place.


text: Cybersecurity and Data Privacy Risks We are subject to cybersecurity and data privacy risks. Cyberattacks and security vulnerabilities could lead to increased costs, liability claims, or harm to our competitive position.


text: Cybersecurity Risks Our operations and the operations of our and partners involve the storage, transmission, and processing of third parties' and our data, including personal, confidential, or proprietary information. This data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety of methods to exploit potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized access, loss, misuse, disclosure, modification, or destruction of this data.


text: We are committed to protecting our third parties' and our data. Despite efforts, our systems, products, and services remain vulnerable to attacks.


text: Data privacy issues are becoming increasingly significant due to the rapidly changing legal and regulatory landscape. Compliance with global and local data privacy laws requires ongoing investment in our information technology and employee training, and will continue to impact our business.


text: We should have a formal risk management program that addresses cybersecurity and data privacy risks. This program should include regular reporting to our senior management and Board of Directors, who provide oversight and direction. We have not established an enterprise risk management framework to assess and prioritize these risks.


text: We maintain an incident response plan that includes policies and procedures for notifying affected third parties and complying with applicable laws.


text: Investments in Cybersecurity We will continually invest in our cybersecurity capabilities to protect our assets and those of our third parties. This potentially will include investment in advanced threat detection, encryption, and other security measures. Recent Cybersecurity Incidents During the last fiscal year, we did not experienced cybersecurity incidents.


text: W e do not maintain any information systems that would be subject to a cybersecurity threat. Our credit card processing is outsourced to a third party that uses a double authentication protocol.

companyName: INNOVATIVE DESIGNS INC

ticker: IVDN


text: We are a pre-clinical-stage biopharmaceutical company, focused on developing novel and proprietary drug delivery systems across various pain indications and treatments for CNS disorders. We have conducted a cyber security risk assessment performed by a third-party consultant and are in the process of developing a formal cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The risk assessment was performed against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") standards.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes an assessment of vendors during the selection/onboarding process and a review of SOC 1 reports on an annual basis.


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized IT providers leveraging third-party technology and expertise. These third-party service providers are a key part of our current cybersecurity risk management and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols and critical data backups. Our outsourced information technology consultant conducts proactive patching and monitoring of all of our existing systems and has implemented systems and procedures to mitigate cybersecurity risks that we believe are appropriate for a company of our size, stage of growth and financial condition. In addition, we carry insurance with coverage for cyber events that we believe is suitable for a company of our size, stage of growth and financial condition.


text: we are not aware of any cybersecurity threats, and have not experienced any cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition.


text: For additional information concerning risks related to cybersecurity, see Item lA. Risk Factors: We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks.


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors has responsibility for the oversight of risk management, including as to risks from cybersecurity threats. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. The Board of Directors has delegated to the Audit Committee of the Board of Directors the responsibility for the oversight of information technology, including cybersecurity risks. Member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, emerging threat landscape and new cyber risks, and provide updates on our processes to prevent, detect, and mitigate cybersecurity incidents.


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have undertaken an assessment of our networking risk management processes and controls to identify, quantify, and categorize material risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We consult with a third-party specialist with regard to our cyber risk management processes and controls.


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: BioCrude utilizes the specialized services of an IT professional, to protect its internet-connected systems, such as hardware, software and data from unauthorized access to its data centers and other computerized systems. We deploy collective methods, technologies, and processes to help protect the confidentiality, integrity, and availability of computer systems, networks and data. Part and parcel of our cybersecurity is, continuously updating our licensed/purchased software, running up-to-date antivirus software, having firewalls (Secure for BioCrude's website provided by its website hosting agent, and Watchguard systems as a gatekeeper to the internet), as well as being prudent on continuously changing usernames and passwords and being cognizant and suspicious of unexpected emails (Phishing emails are currently one of the most prevalent risks to the average user).


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the President who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our President.


text: Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, and Chief Financial Officer. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents including significant breaches to the Company's networks or systems. The audit committee receives regular reports from the information technology team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Cybersecurity Risk Management Strategy includes a myriad of tools and resources that are designed to ensure the integrity of our information systems. We place particular emphasis on protecting the privacy of our patient data pursuant to the HIPAA Security Rule. Our cybersecurity risk management process is integrated with our larger risk management system and is considered a core function of our overall risk management strategy.

companyName: FONAR CORP

ticker: FONR


text: Our strategy is based around identification, mitigation, avoidance and response to material cybersecurity risks. We employ physical and electronic safeguards to control access to our systems. We employ additional electronic safeguards to control/limit access to the data contained in those systems. We review and re-assess these processes on a rolling basis with the assistance of both internal staff and outside vendors, including assessors, consultants, auditors, and other third parties. Some steps we take include the use of standard security protocols such as password maintenance, multi-factor identification, and penetration testing. We take other steps as may be situationally appropriate for the specific risk presented.


text: For the fiscal year ended June 30, 2025, management has identified a material weakness in our internal controls over our information technology systems, as described in greater detail in Item 9A. In response, we have taken several steps to enhance our cybersecurity efforts. Those steps include increasing the scope of our Multi-Factor Authentication requirement to include additional tertiary information systems, improving password security, upgrading our anti-virus software, upgrading our threat detection tools, implementing additional threat detection tools, and replacing and/or decommissioning hardware that has known vulnerabilities.


text: We require all of our employees to receive cybersecurity training as part of their initial onboarding process, and employees are required to complete additional training throughout the year.


text: We evaluate all of our vendors and third-party partners for material cybersecurity risks and take steps to mitigate risk through insurance and contractual risk transfer provisions when appropriate.


text: Our Information Technology department works collaboratively with our third-party vendors to coordinate a mutually beneficial approach to cybersecurity in the specific context in which risk is presented. These collaborations sometimes take place on a rolling basis, and sometimes take place on a semi-annual or annual basis.


text: Cybersecurity threats, including previous cybersecurity incidents, have not materially affected our results of operations or financial condition. However, cybersecurity threats have the potential to significantly impair our operations and the operations of the various third parties upon whom we rely.


text: The audit committee of our Board of Directors provides oversight of cybersecurity risks. It receives regular reports from management, including our General Counsel, on various cybersecurity matters during each board meeting. Such reports include information on current cybersecurity risks facing the organization, cybersecurity incidents involving our partners and/or other participants in our industry, and routine updates on the status of our internal cybersecurity risk management plan.


text: Our General Counsel oversees and manages our cybersecurity program. Our General Counsel acts as the coordinator of our cybersecurity team, which includes representatives from our Information Technology department and Compliance department. In addition, he regularly interacts with various department heads from both our New York and Florida regions regarding the prevention, detection, mitigation and remediation of cybersecurity risks. Our General Counsel has an educational background in computer science and has relevant work experience in cybersecurity insurance and risk management.


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting companies similar to ours operating in the technology, software and identification space. All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data customers and other stakeholders entrust to us a top priority. Our Board of directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective to prevent cyberattack incidents. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in cyberattack volume, frequency, and sophistication. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that as of the date of this Annual Report on Form 10-K, risks from prior cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: VisionWave Holdings, Inc.

ticker: VWAV


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are based on frameworks established by the International Organization for Standardization, specifically ISO/IEC 27001:2013 and other applicable industry standards. We have established comprehensive Information Security Management Systems ("ISMS") policies, which are independently reviewed and audited annually for conformity and effectiveness under ISO/IEC 27001. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders, including a member of the Board meet at least monthly to develop strategies for preserving the confidentiality, integrity and availability of our company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board and members of management. Risk assessment is integral to all engineering, business and operational decisions and in addition to the annual reviews, is an ongoing effort, as circumstances and facts arise.


text: At least annually we conduct a self-audit of our information security management systems ("ISMS"), in order to identify if there is any non-conformance with our ISMS policies and procedures. The results of the self-audit are reported to our Steering Committee and our external auditor for ISO/IEC 27001 compliance.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address — and guide our employees, management and the Board on — our response to a cybersecurity incident.


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding and contract renewal. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through regular privacy and security training and testing to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external independent auditors. These assessments include a variety of activities including information security assessments, audits and independent reviews of our ISMS, control environment and operating effectiveness. For example, in 2023 and 2024, we conducted independent audits to assess our ISMS against the ISO/IEC 27001:2013 standard and received certification of compliance with the standard. We also undertake regular penetration testing of our systems. The results of significant assessments are reported to management and the Board. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us.


text: Our Board oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Security Committee directly oversees our cybersecurity program. The Board receives periodic updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Our Chief Technology Officer ("CTO") and Chief Operating Officer ("COO") have primary responsibility for assessing and managing material cybersecurity risks. Our CTO and COO are both seasoned computer scientists and technology entrepreneurs with over 25 years of experience.


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO") with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Litecoin Trust (LTC)

ticker: LTCN


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Sponsor's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board about any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: During the year ended June 30, 2025, we did not identify any cybersecurity threats at the Sponsor or the Trust that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


companyName: Grayscale Bitcoin Cash Trust (BCH)

ticker: BCHG


text: Processes of Addressing Cybersecurity Threats Cybersecurity is critical to our business. As an energy infrastructure company, we face a variety of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, that target critical infrastructure sectors. We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. The process is supported by management and overseen by our board of directors.

companyName: Northwest Natural Holding Co

ticker: NWN


text: One of the tools used by management and our Board of Directors in managing business risks is an annual enterprise risk management (ERM) assessment to identify and manage key existing and emerging risks our company faces. Our ERM process is designed to identify significant risks relevant to the company and assess the characteristics and circumstances of the risks to identify both the potential impacts to our company of a particular risk and the velocity with which the risk may manifest. Cybersecurity is among the risks identified in our ERM assessment and has been embedded in the Company's operating procedures, internal controls and information systems. In addition to our overall ERM process, we have developed and implemented a cybersecurity risk management program and processes intended to detect, assess, manage, and develop resiliency against material risks from cybersecurity threats. Our cybersecurity program utilizes a risk-based approach and includes written cybersecurity and information technology processes and procedures, including a cybersecurity incident response plan that involves procedures for responding to cybersecurity incidents. We design and assess our program informed by various cybersecurity frameworks, such as the National Institute of Standards and Technology (NIST) and leverage a widely-adopted risk assessment model to identify, measure and prioritize cybersecurity and technology risks. The goal of our program is to prevent, identify, escalate, investigate, resolve and recover from identified incidents and security incidents in a timely manner.


text: Our cybersecurity program also incorporates intelligence sharing capabilities about emerging threats within the utility industry and other industries through collaboration with peer companies and specialized consultants and advisors, public-private partnerships with government intelligence agencies, including the FBI, CISA, and the Department of Energy Office of Cybersecurity, Energy Security and Emergency Response, and geopolitical briefings. We also leverage third-party benchmarking, the results from regular internal and third-party audits, technology partner resources, threat intelligence feeds, and other similar resources to inform our cybersecurity processes and allocate resources.


text: Beginning in May 2021, the Department of Homeland Security's (DHS) Transportation Security Administration (TSA) released two directives, with several updates, applicable to certain owners and operators of pipeline facilities, including NW Natural. These directives cumulatively required owners and operators to implement cybersecurity incident reporting to the DHS, designate two cybersecurity coordinators, and perform a gap assessment of current entity cybersecurity practices against certain voluntary TSA security guidelines and report relevant results and proposed mitigation to applicable DHS agencies; implement a significant number of specified cyber security controls and processes; and clarifying Operational Technology (OT) scope and providing a risk- and outcome-based framework. We made significant additional and accelerated investments in cybersecurity in response to the TSA directives.


text: Our cybersecurity program has several fundamental tenants, including security governance, cybersecurity risk management, compliance, defensibility, zero-trust architecture and cloud security. We utilize multilayered defenses and continuous monitoring with data analytics to detect anomalies and search for cyber threats in our system.


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader technology environment; • the use of external service providers with specific expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel and senior management, as well as periodic experiential learning through "phishing simulations"; • segmentation of, and back-ups for, certain of our sensitive systems and data; • third-party cyber risk management process for vendors including, among other things, a security assessment, contracting program, and ongoing monitoring for vendors based on their risk profile; • physical security around our sensitive infrastructure and cybersystems.


text: In accordance with our program and processes, we regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program and also utilize audits by our internal audit team and third-party consultants, table-top exercises, penetration and vulnerability testing, data recovery testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We are continuously working to evolve our oversight processes to mature how we identify and manage cybersecurity risks, and we perform periodic maturity assessments to measure our progress.


text: As a regulated energy infrastructure company, for decades we have used an incident command system (ICS) as a standardized approach to the command, control and coordination of a variety of emergency situations. In the event of emergencies, including cybersecurity events, we stand up an Incident Command Team to respond to the emergency. We exercise and train the ICT for a variety of emergencies, including, cyber events on a regular basis.


text: At this time, we have not identified any risks from known previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. With a majority of our business in energy and infrastructure, we face sophisticated and rapidly evolving attempts to overcome our security measures and protections. The occurrence of both intentional and unintentional incidents could occur in the future. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors" above for additional information on risks related to our business, including for example risks related to cyber attacks, information and system breaches, and technology disruptions and failures, our reliance on technology.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity risk management program.


text: The Audit Committee receives regular reports from management on our cybersecurity risks. Additionally, management updates the Audit Committee as necessary, regarding any cybersecurity incidents. The Audit Committee reports to the full Board regarding the Audit Committee's areas of oversight, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program periodically. Additionally, our Board receives presentations on cybersecurity topics from our IT management team or external experts as part of the Board's ongoing education.


text: Our management team, including our Cybersecurity management team, has primary responsibility for our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity management team has been led, since 2017, by our Vice President, Chief Information Officer, who also functions as our Chief Information Security Officer and reports to our CEO. Mr. Downing has an extensive career of 29 years in information technology services in the energy sector, including at WorleyParsons, British Petroleum and Schlumberger. He holds a degree in Information Systems as well as a Masters of Business Administration.


text: Mr. Downing is supported by Mr. Carlson, our Director of Cybersecurity and Compliance, and his team. Mr. Carlson has 24 years of experience in information technology focused on highly regulated sectors including energy, government, and insurance. He holds a bachelor's degree in Information Technology, and master's degrees in Information Assurance and Business Administration. The remainder of our team is comprised of cybersecurity professionals with broad experience and expertise, including in cybersecurity, threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Collectively our team has certifications from various organizations such as American Society for Industrial Security, AXELOS, Cloud Security Alliance, Information Systems Audit and Control Association, International Information System Security Certification Consortium and SANS Institute.


text: Our cybersecurity and compliance team regularly collects data on cybersecurity threats and risk areas, monitors our systems, and conducts testing to assess our processes and procedures and the threat landscape. The CIO receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.


text: In the event of an incident, we intend to utilize our ICT and follow our detailed incident program and processes, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying relevant functional areas, as well as senior leadership and the Board, as appropriate.


text: Processes of Addressing Cybersecurity Threats Cybersecurity is critical to our business. As an energy infrastructure company, we face a variety of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, that target critical infrastructure sectors. We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. The process is supported by management and overseen by our Board of Directors.


text: Beginning in May 2021, the Department of Homeland Security's (DHS) and the Transportation Security Administration (TSA) released two directives, with several updates, applicable to certain owners and operators of pipeline facilities, including NW Natural. These directives cumulatively require owners and operators to implement cybersecurity incident reporting to the DHS, designate two cybersecurity coordinators, and perform a gap assessment of current entity cybersecurity practices against certain voluntary TSA security guidelines and report relevant results and proposed mitigation to applicable DHS agencies; implement a significant number of specified cyber security controls and processes; and clarifying Operational Technology (OT) scope and providing a risk- and outcome-based framework. We made significant additional and accelerated investments in cybersecurity in response to the TSA directives. In November 2024, the TSA proposed regulations with the aim of making the security directives permanent by incorporating them into the US Code of Federal Regulations.


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader technology environment; • the use of external service providers with specific expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel and senior management, as well as periodic experiential learning through "phishing simulations"; • segmentation of, and back-ups for, certain of our sensitive systems and data; • third-party cyber risk management process for vendors including, among other things, a security assessment, contracting program, and ongoing monitoring for vendors based on their risk profile; and • physical security around our sensitive infrastructure and cybersystems.


text: As a regulated energy infrastructure company, for decades we have used an incident command system (ICS) as a standardized approach to the command, control and coordination of a variety of emergency situations. In the event of emergencies, including cybersecurity events, we stand up a cross-functional Incident Command Team (ICT) to respond to the emergency. We exercise and train the ICT for a variety of emergencies, including cyber events on a regular basis.


text: At this time, we have not identified any risks from known previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. With a majority of our business in energy and infrastructure, we face sophisticated and rapidly evolving attempts to overcome our security measures and protections. The occurrence of both intentional and unintentional incidents could occur in the future. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors" above for additional information on risks related to our business, including for example risks related to cyber attacks, information and system breaches, technology disruptions and failures, and our reliance on technology.


text: Our management team, including our Cybersecurity management team, has primary responsibility for our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity management team is led by Brian Fellon, our Vice President, Chief Information Officer and Chief Information Security Officer (VP, CIO and CISO). Mr. Fellon joined NW Natural and was appointed to his role by the Board of Directors in September 2024. Mr. Fellon reports to our Chief Financial Officer. He has 28 years of experience in information technology. Prior to joining NW Natural, Mr. Fellon served as Director of Information Technology at Puget Sound Energy in Bellevue, Washington from 2016 to September 2024, where he was responsible for applications services, artificial intelligence and data.


text: Mr. Fellon is supported by our Director of Cybersecurity and Compliance, and his team. Collectively our team has certifications from various organizations such as American Society for Industrial Security, AXELOS, Cloud Security Alliance, Information Systems Audit and Control Association, International Information System Security Certification Consortium and SANS Institute.


text: Our cybersecurity and compliance team regularly collects data on cybersecurity threats and risk areas, monitors our systems, and conducts testing to assess our processes and procedures and the threat landscape. Our VP, CIO and CISO receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.


text: We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. We have an enterprise risk management framework that is designed to identify, measure, control, monitor and mitigate risks across various aspects of our business and operations, including, credit, interest rate, liquidity, operational, regulatory compliance, strategic, reputational, and legal risks. As we rely and continue to increase our reliance on technology and given the constant state of cyber threats, information security or cybersecurity is a significant component of our enterprise risk management framework. Our Chief Information Security Officer, a key member of our risk management organization, who has overall responsibility, accountability, and ownership for this cybersecurity component, reports directly to the Chief Risk Officer and periodically presents reports to the Risk Committee of our Board of Directors.

companyName: Amerant Bancorp Inc.

ticker: AMTB


text: We are actively engaged in identifying, managing, and mitigating cybersecurity risks with the objective of avoiding or minimizing the impact of malicious and non-malicious actions and threats aimed at penetrating, disrupting or misusing our systems and information. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is deemed critical. We have developed and implemented an enterprise-wide information security program, which is designed to protect the availability, integrity, and confidentiality of customer non-public information and company data, including the protection of the hardware and infrastructure used to store and transmit such information. Our Information Security Program is structured and aligned with the Federal Financial Institution Examination Council ("FFIEC") guidelines for information security, regulatory guidance, and other industry standards. To promote the continued effectiveness of our information security program, we periodically conduct risk assessments, complete audits and tests, participate in industry associations, and review information from threat intelligence feeds. In addition, our Chief Information Security Officer and members of his team and of our Information Technology team regularly collaborate with external parties, including regulatory agencies, other banks and industry groups to share cyberthreat information, trends and issues and identify best practices.


text: We leverage knowledge, people, processes, and technology to develop, implement, manage, and maintain cybersecurity controls. Our information security program employs several detective and defensive tools designed to monitor, alert, and block suspicious activity, as well as to identify, report and address any suspected threats. Our information security program is a continuous on-going periodically updated program that is supported by policies, procedures, standards and guidelines; an Enterprise-wide Vendor Management Program; a Technology Project Management Office (PMO) and an Enterprise-wide Business Continuity and Disaster Recovery Program. This integration is aimed at ensuring that program is embedded into the organization's lines of business, support functions and third-party vendor management program.


text: We have implemented controls that align information security standards with the nature of our operations and strategic direction. When possible, we implement layered control systems by deploying different controls at different points of business processes and throughout an IT system so that the strength of one control can compensate for weaknesses in or possible failure of another control. We have also developed an enterprise-wide vendor management and third-party risk management program designed to identify, assess, and manage information security, operational and technology risks associated with third-party vendors. Our Enterprise-wide Vendor Management Program is in alignment with the FFIEC Guidelines for Third Party Service Providers and is designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers. Our Information Security Program also continuously promotes cybersecurity awareness and culture across the organization, including regular education and training, that requires team members to complete training and certification on an annual basis and phishing simulations (attempts of attacks) monthly. New hires are also provided with information security awareness training during the orientation process. A customer security awareness and communication program has also been developed and implemented to keep customers abreast of security and fraud risks.


text: While we believe that our business, financial condition, or results of operations have not been materially adversely affected by any cybersecurity incidents, cybersecurity threats are common and pervasive and, we, as well as our customers, regulators, and service providers, have experienced and will likely continue to experience a significant increase in information security and cybersecurity threats and attacks, see "Our information systems are exposed to cybersecurity threats and may experience interruptions and security breaches that could adversely affect our business and reputation" in Item 1A. Risk Factors. We continuously assess the risks and changes in the cyber environment and update our information security program to reflect the results of risk assessments and the key controls necessary to safeguard customer information and ensure the proper disposal of customer information. The program is updated considering changes in technology, the sensitivity of our customer information, internal or external threats to information, and our own changing business environment which can include mergers and/or acquisitions, outsourcing arrangements, and changes in customer information systems which may have material impact on the program. We also leverage control testing of key controls, systems, and procedures of our information security program performed by internal and external auditors and external partners, that is periodically completed to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We have developed and maintain an incident response plan that provides a documented procedure to respond and address cybersecurity incidents, including timely notification to the Executive Management Committee and the Risk Committee of the Board of Directors. The incident response plan provides for the interaction and coordination of executive, strategic and tactical teams, depending on the severity level of the incident, aimed at facilitating coordination across multiple units and departments of the Company. Our incident response plan is tested at least annually.


text: The Information Security Department, under the leadership of the Chief Information Security Officer, has the responsibility for implementation and monitoring our information security program. The responsibilities of this department include cybersecurity risk assessments, vulnerability management, access reviews for systems and applications, incident response and management, gathering and sharing threat intelligence, monitoring of controls, and overall responsibility for the development of the information security program including relevant policies, procedures, standards and guidelines to enhance data security and mitigate risks. Members of this department include individuals with varying degrees of education and experience, in particular, our Chief Information Security Officer has over twenty years of experience in information technology and risk management, with emphasis on information security and cyber security risk management; throughout his career he has served in different positions including as Information Technology Auditor, Technology Risk Manager, Information Security Program Manager and, since September 2018 as our CISO. He has a bachelor's degree in computer systems analysis and has obtain several relevant certifications, including having completed the EC-Council's Certified Chief Information Security Officer Program and obtaining the Information Systems Auditor and Risk and Information Systems Control certifications from the Information Systems Audit and Control Association, ISACA. Several management committees, including our Executive Management Committee, manage our information security program and meet periodically to review and discuss information security matters. In general, summaries of key matters discussed are reported to the Risk Committee.


text: Our Board, through the Risk Committee, is actively engaged in the oversight of our information security program. The Risk Committee oversees our information security program, including management's actions to identify and evaluate, material cyber vulnerabilities, threats, and risks as well as the development and implementation of mitigating and remediating actions. Our Chief Information Security Officer presents quarterly reports to the Risk Committee regarding our information security program, including relevant information on key risk and performance indicators related to cybersecurity matters as well as significant cybersecurity and privacy events. In addition, our information security risk profile is presented to the Risk Committee on a semi-annual basis.


text: The Information Security Department, under the leadership of the Chief Information Security Officer, has the responsibility for implementation and monitoring our information security program. The responsibilities of this department include cybersecurity risk assessments, vulnerability management, access reviews for systems and applications, incident response and management, gathering and sharing threat intelligence, monitoring of controls, and overall responsibility for the development of the information security program including relevant policies, procedures, standards and guidelines to enhance data security and mitigate risks. Members of this department include individuals with varying degrees of education and experience, in particular, our Chief Information Security Officer has over twenty seven years of experience in information technology and risk management, with emphasis on information security and cyber security risk management; throughout his career he has served in different positions including as Information Technology Auditor, Technology Risk Manager, Information Security Program Manager and, since September 2018 as our CISO. He has a bachelor's degree in computer systems analysis and has obtained several relevant certifications, including having completed the EC-Council's Certified Chief Information Security Officer Program and obtaining the Information Systems Auditor and Risk and Information Systems Control certifications from the Information Systems Audit and Control Association, ISACA. Several management committees, including our Executive Management Committee, manage our information security program and meet periodically to review and discuss information security matters. In general, summaries of key matters discussed are reported to the Risk Committee.


text: The Company's cybersecurity objective is to protect Garrett against data privacy breaches, information theft, and external and insider cyber threats through the use of a combination of leading technologies, policies, and procedures. The Company has processes in place to identify, assess and monitor material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management ("ERM") process and have been embedded in the Company's operating procedures, internal controls and information systems. To that end, we take a holistic approach to securing our data and business systems from attack, compromise or loss.

companyName: Garrett Motion Inc.

ticker: GTX


text: The Company has cybersecurity capability including a Security Operations Center ("SOC") that is managed by a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading the Company-wide cybersecurity strategy, policy, standards, architecture, and processes. The SOC provides visibility across all information technology assets and includes proactive cyber security threat detection technology to facilitate the identification of misconfigurations to mitigate threats and prevent data loss. As part of the Company's holistic approach to cybersecurity, we have implemented programs and technology associated with threat hunting, vulnerability scanning, and threat detection and response technology.


text: As part of its cybersecurity risk management, the Company delivers specific education to the organization on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees globally on a regular basis and may be supplemented by various testing initiatives including periodic phishing tests.


text: The Company leverages third-party expertise for periodic effectiveness testing of its prevention, detection, and response capabilities. The Company also requires all third-party service providers to meet certain cybersecurity requirements, including risk assessment and monitoring activities. In addition, third-party service providers with access to the Company's network are also required to undertake cybersecurity training.


text: While Garrett focuses heavily on prevention and detection, response and recovery plans, service agreements and partner engagements are in place should there be a need for us to respond to a cybersecurity attack. The Company's response process includes identifying the incident; notifying the executive team, activating the crisis team, assessing the business risk and materiality of the incident; managing the recovery of operations; and performing a post-incident analysis. The Company maintains business continuity and disaster recovery plans. The Company also engages in cyber crisis response simulation to assess our incident response ability and effectiveness.


text: No cybersecurity incidents have occurred that materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition during the year ended December 31, 2023. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Role of Management The Company has a Cyber Risk Governance Council consisting of the Senior Vice President Chief Digital and Information Officer ("CDIO"), the CISO, the IT leadership team, and the legal and cybersecurity teams that focuses on cybersecurity and compliance risks. The Cyber Risk Governance Council meets monthly to review cybersecurity risks and related risk management methodologies. Cybersecurity risks are included in the Company's ERM as appropriate based on potential impact and vulnerability assessed according to certain set criteria and defined ERM materiality thresholds. Regular discussions over cybersecurity developments and risk mitigation approaches are held by the Cyber Risk Governance Council with the Chief Executive Officer and the senior leadership team.


text: Role of the Board The Board of Directors is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk. The Board has delegated responsibility for oversight of the Company's cybersecurity framework and risk management to the Audit Committee.


text: The CDIO and CISO provide reports to the Audit Committee at least semi-annually on the Company's cybersecurity program including the external threat environment, the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and the results of evaluation of the Company's cybersecurity program by external experts. The Audit Committee, as well as the Board of Directors, is also promptly informed about any information security incidents that may pose significant risk to the Company.


text: The Company has cybersecurity capability, including a Security Operations Center ("SOC") that is managed by a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading the Company-wide cybersecurity strategy, policy, standards, architecture, and processes. The SOC provides visibility across all information technology assets and includes proactive cyber security threat detection technology to facilitate the identification of misconfigurations to mitigate threats and prevent data loss. As part of the Company's holistic approach to cybersecurity, we have implemented programs and technology associated with threat hunting, vulnerability scanning, and threat detection and response technology.


text: No cybersecurity incidents have occurred that materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition during the year ended December 31, 2024. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Role of Management The Company has a Cyber Risk Governance Council consisting of the Senior Vice President Chief Digital and Information Officer ("CDIO"), the CISO, the IT leadership team, and the legal and cybersecurity teams that focuses on cybersecurity and compliance risks. The Cyber Risk Governance Council meets monthly to review cybersecurity risks and related risk management methodologies. Cybersecurity risks are included in the Company's ERM as appropriate based on potential impact and vulnerability assessed according to certain set criteria and defined ERM materiality thresholds. Regular discussions over cybersecurity developments and risk mitigation approaches are held by the Cyber Risk Governance Council with the Chief Executive Officer and the senior leadership team. The CISO has over 27 years of experience in IT in various capacities with over 21 years in cybersecurity, reporting into the CDIO, who has over 20 years of IT related experience.


text: The CDIO and CISO provide reports to the Audit Committee at least semi-annually on the Company's cybersecurity program, including the external threat environment, the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and the results of evaluation of the Company's cybersecurity program by external experts. The Audit Committee, as well as the Board of Directors, is also promptly informed about any information security incidents that may pose significant risk to the Company.


text: As an externally managed closed-end management investment company that has elected to be treated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior Blackstone Credit & Insurance professionals and each of the Adviser and Administrator is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data entrusted to it, including by us and the Adviser, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI"), and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by Blackstone's CSO and members of BXTI and Blackstone's Legal and Compliance.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.