text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: Cipher Digital Inc.

ticker: CIFR

secItem: Item 1C


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer (CTO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Members of the Audit Committee have experience in overseeing and managing cybersecurity and data privacy risks.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our management team have prior work experience in supervising and implementing cybersecurity risk mitigation efforts in highly-regulated industries. Our internal cybersecurity personnel and retained external cybersecurity consultants also have a breadth of expertise across core cybersecurity disciplines including governance, risk, compliance, and security architecture.


text: Our management team takes steps to stay informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We rely on information technology and data to operate our business and develop, market and deliver our services to our customers. Our information technology includes various cloud computing resources, computer networks, third party hosted services, communications systems, software, and our data (which includes confidential, personal, proprietary and sensitive data) (collectively "Information Assets"). We maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business.

companyName: Grindr Inc.

ticker: GRND


text: We rely on a multidisciplinary team (including information security stakeholders and management, as described further below in "Cybersecurity—Governance") to help assess how cybersecurity threats to our Information Assets could impact our business. We seek to assess the likelihood that such threats could result in a material impact to our Information Assets, operations, ability to provide our services, our core business functions, personnel, reputation, and identified critical business objectives. We identify, assess, and manage our cybersecurity threats and risks by, among other things, ongoing threat modeling discussions of certain of our applications and infrastructure, reviewing certain weekly security bulletins, monitoring the threat environment using manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, analyzing reports of certain threats and actors, scans of certain threat environment, evaluating our industry's risk profile, evaluating threats reported to us from our public-facing bug bounty program, conducting threat assessments for certain internal and external threats, and conducting vulnerability assessments in some environments and systems aimed at identifying vulnerabilities.


text: Based on our assessment process, we implement and maintain various technical, physical and organizational measures, processes, standards, and policies designed to manage and mitigate such risks and potential material impacts to our Information Assets. The various risk management and reduction measures we implement for certain areas of our environment and systems include: maintaining policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; conducting internal and external audits designed to assess our exposure to certain cybersecurity threats, compliance with internal risk mitigation procedures, and effectiveness of relevant controls; conducting background checks on certain of our and our third parties' personnel; adopting network security controls in certain environments and systems; segregating certain data; adopting physical and electronic access controls and; asset management procedures monitoring certain systems; implementing a vendor risk management program; training employees on security; conducting red/blue team exercises; maintaining cyber insurance; maintaining a dedicated information security staff; and using a third-party managed security operations center. We seek to prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as exposure of customer data, interruption of services, ransomware, intrusion of networks, and data exfiltration or exposure.


text: Risk from cybersecurity threats are among those that we address in the Company's general risk management program. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program, and the security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: To operate our business, we rely on third party service providers to perform a variety of functions, such as SaaS platforms, managed services, property management, cloud-based infrastructure, content delivery to customers, encryption and authentication technology, and corporate productivity services. We have a vendor management program designed to help manage cybersecurity risks associated with our use of these providers. The program includes risk assessments for certain vendors; security questionnaires for certain vendors; review of certain vendor's written security program and security assessments; and imposition of information security contractual obligations on the vendor.


text: Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and contractually impose obligations onto them related to the services they provide and/or the information they process.


text: For service providers that provide particularly critical services to us or process particularly sensitive information for us, we follow our third party vendor review processes involving stakeholders throughout the company. This includes multiple levels of due diligence prior to an engagement to assess what, if any, user data or confidential information the vendor may receive access to, what controls should be implemented around such access, and validating that the contractual rights and obligations conform to our policies and practices.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section titled "Risk Factors—Risks Relating to our Business—Security breaches, unauthorized access to or disclosure of our data or user data, other hacking and phishing attacks on our systems or those of third parties upon which we rely, or other data security incidents could compromise sensitive information related to our business or users processed by us or on our behalf and expose us to liability, which could harm our reputation, generate negative publicity, and materially and adversely affect our business."


text: Our Board of Directors oversees the Company's risk management strategy with respect to cybersecurity threats as part of its general oversight function. The Board of Directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk management strategy relies on input from certain members of management, including our Senior Vice President of Engineering and Chief Information Security Officer (reporting to our Chief Executive Officer) in consultation with our General Counsel and Head of Global Affairs (reporting to our Chief Executive Officer), our Chief Privacy Officer (reporting to our General Counsel) and input from various leaders who participate in our Privacy and Security Council. This team helps us understand cybersecurity threats and risks, establish priorities, and determine the scope, elements, and implementation of a cybersecurity program. The team is also responsible for integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees.


text: Every quarter, the Privacy and Security Council meets to discuss certain cybersecurity risks and upcoming changes to our legal obligations that may affect our cybersecurity program, and to review our cybersecurity program. Our cybersecurity team is responsible for preparing for any cybersecurity incidents, responding to any cybersecurity incidents, approving cybersecurity policies and procedures, and reviewing cybersecurity-related audit reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our SVP Engineering and Chief Information Security Officer, General Counsel and Head of Global Affairs, and Chief Privacy Officer, as appropriate. In addition, our incident response plan includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Board of Directors, through its Audit Committee, holds at least quarterly meetings to discuss the matters within the Audit Committee's scope, including to review and discuss our cybersecurity threat management. The Audit Committee oversees matters related to cybersecurity threats and hears reports from our SVP Engineering and Chief Information Security Officer about our guidelines, policies, and practices regarding cybersecurity risks as well as any updates of certain cybersecurity threats faced by us and steps we are taking to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats risk and mitigation.


text: Based on our assessment process, we implement and maintain various technical, physical and organizational measures, processes, standards, and policies designed to manage and mitigate such risks and potential material impacts to our Information Assets. The various risk management and reduction measures we implement for certain areas of our environment and systems include: maintaining policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; conducting internal and external audits designed to assess our exposure to certain cybersecurity threats, compliance with internal risk mitigation procedures, and effectiveness of relevant controls; conducting background checks on certain of our and our third parties' personnel; adopting network security controls in certain environments and systems; segregating certain data; adopting physical and electronic access controls and; asset management procedures monitoring certain systems; implementing a vendor risk management program; training staff on security; conducting red/blue team exercises; maintaining cyber insurance; maintaining a dedicated information security staff; and using a third-party managed security operations center. We seek to prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as exposure of customer data, interruption of services, ransomware, intrusion of networks, and data exfiltration or exposure.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the section titled "Risk Factors—Risks Relating to our Business—Security breaches, unauthorized access to or disclosure of our data or user data, other hacking and phishing attacks affecting our information technology systems or those of third parties with whom we work, or other data security incidents could compromise sensitive information related to our business or users processed by us or on our behalf and expose us to liability, which could harm our reputation, disrupt the availability of our systems and services, generate negative publicity, and materially and adversely affect our business."


text: Our cybersecurity risk management strategy relies on input from certain members of management, including our Senior Vice President of Engineering and Chief Information Security Officer ("CISO") (reporting to our Chief Executive Officer) in consultation with our General Counsel and Head of Global Affairs (reporting to our Chief Executive Officer), our Chief Privacy Officer (reporting to our General Counsel) and input from various leaders who participate in our Privacy and Security Council. This team helps us understand cybersecurity threats and risks, establish priorities, and determine the scope, elements, and implementation of a cybersecurity program. The team is also responsible for integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees.


text: Our CISO leads our global information security organization responsible for overseeing the Grindr cybersecurity program which is designed to maintain the confidentiality, integrity and availability of Grindr's data assets. Our CISO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public and private companies. Team members who support our cybersecurity program have deep educational and industry experience. The CISO attends quarterly meetings with our Audit Committee and meets with Grindr's Board of Directors at least annually to brief them on security matters including ongoing cyber threats and risks.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CISO and SVP Engineering, General Counsel and Head of Global Affairs, and Chief Privacy Officer, as appropriate. In addition, our incident response plan includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property loss or theft; fraud; extortion; harm to employees or customers; potential litigation, regulatory investigations or other proceedings, and other legal risks; and reputational risks. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Bakkt, Inc.

ticker: BKKT


text: To identify and assess material risks from cybersecurity threats, our Enterprise Risk Management program considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. We perform specific cybersecurity risk assessments at least annually to identify and assess material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to further identify risks.


text: To provide for the availability of critical data and systems, address regulatory compliance requirements, manage our material risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, we undertake these activities: • undertake an annual review of our policies and statements related to cybersecurity; • conduct cybersecurity awareness training for all employees annually; • conduct privileged access and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable), require employees, as well as applicable third parties who provide services on our behalf, to treat customer information and data with care; • conduct tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the National Institute of Standards and Technology incident handling framework as the foundation of our incident response plan to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the certain potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take in our efforts to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We regularly engage with independent third parties to review our cybersecurity program and assess the effectiveness of our controls. These third parties include our Internal Audit department as well as external reputable and well-known firms, all of which review various aspects of our cybersecurity program, processes, and controls throughout the year.


text: We also maintain processes to address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our systems or data or facilities that house such systems and data. Cybersecurity considerations affect the selection and oversight of these third-party service providers. We perform diligence on these third parties and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that we believe could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and be subject to certain obligations related to their cybersecurity practices.


text: Like other technology companies, we have faced cybersecurity incidents in the past. As of the date of this Annual Report on Form 10-K, however, we have not assessed any risks from prior cybersecurity incidents as having materially affected or being reasonably likely to materially affect us. We face risks from cybersecurity threats, including those associated with cyberattacks and security breaches and incidents, in the future. For additional information regarding whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in "Item 1A. Risk Factors" and "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board's Audit and Risk Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the entire Board receives an overview from management of our cybersecurity program and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Board discusses such matters with our Chief Risk Officer (CRO) and Chief Information Security Officer (CISO). Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our enterprise risk management and strategy processes are led by our CRO. Cybersecurity program management and strategy processes are led by our CISO. Such individuals have collectively over 40 years of prior work experience in various roles involving managing enterprise risk and information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, and Certified Information Systems Security Professional. The CRO and CISO provide regular updates to the executive management team. The executive management team monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their participation in the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the CRO and CISO report to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly.


text: Our commercial success depends on developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Managing Material Risks & Integrated Enterprise Risk Management We are working to strategically integrate cybersecurity risk management into our broader enterprise risk management program to promote a company-wide culture of cybersecurity risk management. Our enterprise risk management project team is working closely with our IT department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs while building out a framework to monitor those risks and integrate objectives into our broader strategic plan.


text: Engaging Third Parties on Risk Management Given the complexity and evolving nature of cybersecurity threats, we have engaged a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating, testing, and improving our risk management systems. These partnerships enable us to leverage specialized knowledge and insights and includes regular audits, threat assessments, and consultation on security enhancements.


text: Overseeing Third Party Risk The need to govern third party service providers and vendors poses significant challenges, and as a result we have implemented processes to oversee and manage these risks. Our procedures contemplate conducting security assessments of all third-party providers that are proportional to the risks present, ideally before or soon after engagement, and periodically thereafter, in order to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, although we cannot rule out that a cyber attack in the future could materially affect our ability to operate.


text: Our Board of Directors (the "Board") is aware of the critical nature of managing risks associated with cybersecurity threats. In recognition of the significance of these threats to our operational integrity and shareholder confidence, the Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.


text: The Nominating and Corporate Governance Committee of the Board bears primary responsibility for oversight of cybersecurity risks. The Nominating and Corporate Governance Committee is briefed on cybersecurity risks at least once each year and any material cybersecurity incidents by the Chief Information Officer ("CIO") and the Chief Legal Officer ("CLO"), as further described below. The Nominating and Corporate Governance Committee is composed of directors equipped with diverse skills needed to oversee the difference facets of cybersecurity risks effectively, including risk management, public company leadership, innovation and technology, corporate governance and finance.


text: Management's Role Managing Risk The CIO and the CLO are responsible for updating the Nominating and Corporate Governance Committee on cybersecurity risks and the Company's mitigation strategies. They provide quarterly updates to the Nominating and Corporate Governance Committee, as well as comprehensive briefings at least once per year and appropriate briefings during any potentially material cybersecurity incident. These briefings encompass a broad range of topics, including: • results of internal assessments and audits by third parties; • the current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and strategies; • incident reports and lessons learned from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to regular scheduled meetings, the Nominating and Corporate Governance Committee, CIO and Chief Executive Officer ("CEO") maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive periodic updates on significant developments in the cybersecurity landscape to support proactive and responsive Board oversight. The Nominating and Corporate Governance Committee actively participates in strategic decisions related to cybersecurity, reviewing and offering guidance on major initiatives and any potentially material cybersecurity incident. This involvement ensures that cybersecurity considerations are integrated into the Company's broader strategic objectives.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CIO, Jovan Kangrga. Mr. Kangrga has managed cybersecurity and information security at Array for the past four years and has over 13 years of total experience as an information technology executive for publicly listed companies. Mr. Kangrga holds B.S. degrees in finance and computer science from Arizona State University as well as a M.B.A. from Western International University. He manages a team with over 40 years of combined experience in cybersecurity. Our CIO reports to our CLO, and both our CIO and CLO are responsible for updating the CEO, the Nominating & Corporate Governance Committee, and the Board on cybersecurity issues.


text: Ongoing Education and Monitoring The CIO leads our cybersecurity team, which remains current with the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing education is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CIO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits, including penetration testing, to identify potential vulnerabilities. In the event of a cybersecurity incident, we are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to the Board of Directors The CIO regularly informs the CLO and CEO of all significant aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential significant risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Nominating and Corporate Governance Committee of the Board and, in certain cases, the Board itself, ensuring that they have comprehensive oversight and can provide guidance on any potentially material cybersecurity incident.


text: Our commercial success depends on developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. Accordingly, we have adopted processes designed to identify, assess and mange material risks from cybersecurity threats.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, although we cannot rule out that a cyber-attack in the future could materially affect our ability to operate.


text: Our board of directors is aware of the critical nature of managing risks associated with cybersecurity threats. In recognition of the significance of these threats to our operational integrity and shareholder confidence, our board of directors has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.


text: The Nominating and Corporate Governance Committee of our board of directors bears primary responsibility for oversight of cybersecurity risks. The Nominating and Corporate Governance Committee is briefed on cybersecurity risks at least once each year and any material cybersecurity incidents by our chief information officer and our chief financial officer, as further described below. The Nominating and Corporate Governance Committee is composed of directors equipped with diverse skills needed to oversee the difference facets of cybersecurity risks effectively, including risk management, public company leadership, innovation and technology, corporate governance and finance.


text: Management's Role Managing Risk The chief information officer and the chief financial officer are responsible for updating the Nominating and Corporate Governance Committee on cybersecurity risks and our mitigation strategies. They provide quarterly updates to the Nominating and Corporate Governance Committee, as well as comprehensive briefings at least once per year and appropriate briefings during any potentially material cybersecurity incident. These briefings encompass a broad range of topics, including: • results of internal assessments and audits by third parties; • the current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and strategies; • incident reports and lessons learned from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to regular scheduled meetings, the Nominating and Corporate Governance Committee, our chief information officer and our chief executive officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive periodic updates on significant developments in the cybersecurity landscape to support proactive and responsive board oversight. The Nominating and Corporate Governance Committee actively participates in strategic decisions related to cybersecurity, reviewing and offering guidance on major initiatives and any potentially material cybersecurity incident. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the chief information officer, Jovan Kangrga. Mr. Kangrga has managed cybersecurity and information security at Array for the past five years and has over 14 years of total experience as an information technology executive for publicly listed companies. Mr. Kangrga holds B.S. degrees in finance and computer science from Arizona State University as well as a M.B.A. from Western International University. He manages a team with over 40 years of combined experience in cybersecurity. Our chief information officer reports to our chief financial officer, and both our are responsible for updating the chief executive officer, the Nominating & Corporate Governance Committee, and our board of directors on cybersecurity issues.


text: Ongoing Education and Monitoring The chief information officer leads our cybersecurity team, which remains current with the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing education is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The chief information officer implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits, including penetration testing, to identify potential vulnerabilities. In the event of a cybersecurity incident, we are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to the Board of Directors The chief information officer regularly informs the chief financial officer and chief executive officer of all significant aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential significant risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Nominating and Corporate Governance Committee of our board of directors and, in certain cases, the board itself, ensuring that they have comprehensive oversight and can provide guidance on any potentially material cybersecurity incident.


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to the our cybersecurity policies, standards, processes and practices, which are integrated into our overall risk management system.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: We take a risk-based approach to cybersecurity aligned with National Institute of Standards and Technology (NIST) principles and have implemented controls throughout our operations that are designed to address cybersecurity threats and incidents. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.


text: Our cybersecurity program and policies articulate the expectations and requirements with respect to acceptable use, education and awareness, security incident management and reporting, identity and access management, vendor due diligence, security (with respect to physical assets, products, networks, and systems), security monitoring and vulnerability identification. Our cybersecurity program and policies are operated by a dedicated cybersecurity operations team in conjunction with our enterprise Risk Management and Compliance program.


text: Our cyber risk management program identifies, tracks, escalates, remediates, and reports cyber related risks throughout the Company. These risk areas include internal, product, vendor, supply chain, and external services utilized across the Company. These risks are assessed, prioritized, and both tactically and strategically addressed via process, technology, and personnel improvements to ensure ongoing mitigation and tracking. We utilize internal and external resources to monitor for cybersecurity threats to our systems and networks and to understand the broader threat environment.


text: Our cybersecurity strategy is guided by prioritized risk, identified areas for improvement based on the NIST Cybersecurity Framework, and emerging business needs. Cybersecurity risks are continually monitored and shared with the executive leadership team on a quarterly basis. We maintain a global incident response plan, coupled with a global continuous monitoring program. This plan and program include incident alerting, comprehensive incident criticality assessments, and escalation processes designed to support our teams, our senior leadership, and the Board. This escalation process also includes cross-functional materiality determinations and applicable reporting requirements.


text: Our cybersecurity operations team manages all facets of cybersecurity monitoring, coordinating with managed services security providers and internal analysts across the Company. All employees are provided cybersecurity awareness training, which includes topics on our policies and procedures for reporting potential incidents. Our cybersecurity team is continuously evaluating emerging risks, regulations, and compliance matters and updating the applicable policies and procedures accordingly.


text: The Board, directly and through its committees, oversees our risk management process, including cybersecurity risks and regularly receive presentations and reports from management. Pursuant to the Risk Management and Compliance Committee Charter, the Risk Management and Compliance Committee of the Board provides compliance oversight of our risk assessment and risk management policies, which include cybersecurity, and receives regular reports and updates on the steps management has taken to monitor and mitigate such exposures and risks.


text: Our Chief Information Security Officer ("CISO"), in coordination with our Chief Technology Officer, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 25 years of experience in information security and presents to the Risk Management and Compliance Committee on a bi-annual basis concerning our cybersecurity program.


text: We have established a cybersecurity program, informed by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), that is designed to safeguard our information systems against cybersecurity threats. This program incorporates a variety of processes and cybersecurity tools designed to assess, identify and manage material risks from cybersecurity threats.

companyName: Affirm Holdings, Inc.

ticker: AFRM


text: Those processes include automated and manual testing of our systems for vulnerabilities as well as monitoring and responding to suspicious activity. We use established cybersecurity risk frameworks to identify, measure and prioritize cybersecurity risks and develop corresponding cybersecurity controls and safeguards, and we have implemented a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents. Leveraging both internal and external resources, we conduct regular reviews and tests, including penetration testing as well as tabletop and red team exercises, to evaluate the effectiveness of our cybersecurity program, enhance our cybersecurity measures, and inform our planning. We periodically engage external auditors and consultants to assess our cybersecurity programs. We also maintain a risk-based approach to identifying and overseeing risks from cybersecurity threats associated with our use of third-party service providers.


text: In addition, we require Affirm employees to participate in cybersecurity awareness training. These training sessions are designed to enhance our employees' awareness of cybersecurity threats and provide information about best practices to protect Affirm's information systems. We require additional tailored cybersecurity training for certain employees based on their specific job responsibilities.


text: Our cybersecurity program is integrated with our overall risk management program through our Chief Information Security Officer's ("CISO") participation in governance structures such as the Risk Management Committee and Technology and Operational Risk Committee, and the incorporation of cybersecurity into the Company's overall compliance and enterprise risk management programs.


text: As of the date of this Report, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: Our Board of Directors has delegated authority to its Audit Committee to oversee risks associated with cybersecurity threats. Members of the Audit Committee receive updates periodically from our CISO regarding cybersecurity risks. These updates include, among other topics, reviews of existing and newly identified cybersecurity risks, status updates on how management is addressing and/or mitigating those risks, information about cybersecurity incidents (if any), as well as updates regarding the status of key cybersecurity initiatives.


text: Our CISO is principally responsible for assessing and managing our cybersecurity risk management program, in partnership with leaders from our Technology, Information Security, Internal Audit, Legal and Compliance teams. Such individuals have an average of over 20 years of prior work experience in various roles involving technology, information security, auditing and compliance. These individuals, including the CISO, are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our CISO then makes periodic reports to the Audit Committee regarding such matters.


text: We have established a cybersecurity program, informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), that is designed to safeguard our information systems against cybersecurity threats. This program incorporates a variety of processes and cybersecurity tools designed to assess, identify and manage material risks from cybersecurity threats.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Director of IT, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we perform daily vulnerability scans on our endpoints; we have a dedicated security operations center ("SOC"), which is run by a third-party; and we conduct data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key vendors, CROs, and other contractors and suppliers. We also conduct regular employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, including our SOC, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: MoonLake Immunotherapeutics

ticker: MLTX


text: Our Director of IT, who reports directly to the Chief Financial Officer and has over 10 years of experience managing information technology and cybersecurity matters and holds various EC-Council certifications including "Certified Chief Information Security Officer", "Certified Ethical Hacker" and "Computer Hacking Forensic Investigator", together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the headings "Failure in our information technology and storage systems or those of third parties upon whom we rely could significantly disrupt the operation of our business and adversely impact our financial condition" and "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer, as well as our Director of IT. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Our Associate Vice President of IT, who reports directly to the Chief Financial Officer and has over 10 years of experience managing information technology and cybersecurity matters and holds various EC-Council certifications including "Certified Chief Information Security Officer", "Certified Ethical Hacker" and "Computer Hacking Forensic Investigator", together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors", under the headings "A cybersecurity incident or failure in our information technology and storage systems or those of third parties upon whom we rely could significantly disrupt the operation of our business and adversely impact our financial condition" and "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer, as well as our Associate Vice President of IT. The Board of Directors also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: In July 2023, the SEC implemented cybersecurity amendments effective for annual reports with fiscal years ending on or after December 15, 2023, which was effective for Navitas beginning in 2023. The board of directors oversees our cybersecurity program, which is managed by our director of IT in collaboration with management of our businesses and functions. During the year ended December 31, 2023, we experienced no material cybersecurity incidents. Our approach to identifying and managing cybersecurity risks involves maintaining an updated firewall, monitored by our director of IT, coupled with annual cybersecurity awareness training for all our employees. We also have email filters to prevent spam and phishing attacks, while anti-virus software on employee computers alerts out IT department to potential threats. We have performed an annual penetration test, conducted by consultants, to ensure the robustness of our cybersecurity. To date, to our knowledge no external entity has successfully breached our system. If a breach is discovered, the director of IT informs our chief financial officer and chief executive officer, who would then communicate the information to our board of directors.

companyName: Navitas Semiconductor Corp

ticker: NVTS


text: In July 2023, the SEC implemented cybersecurity amendments effective for annual reports with fiscal years ending on or after December 15, 2023, which was effective for Navitas beginning in 2023. The board of directors oversees our cybersecurity program, which is managed by our director of IT in collaboration with management of our businesses and functions. During the year ended December 31, 2024, we experienced no material cybersecurity incidents. Our approach to identifying and managing cybersecurity risks involves maintaining an updated firewall, monitored by our director of IT, coupled with annual cybersecurity awareness training for all our employees. We also have email filters to prevent spam and phishing attacks, while anti-virus software on employee computers alerts our IT department to potential threats. We have performed an annual penetration test, conducted by consultants, to ensure the robustness of our cybersecurity. If a breach is discovered, the director of IT informs our chief financial officer and chief executive officer, who would then communicate the information to our board of directors.


text: In the ordinary course of our business, we collect, use, store and transmit digitally large amounts of confidential, sensitive, proprietary, personal and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy, and we consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. To this end, we have implemented processes designed to assess, identify and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity and availability of these systems and the data residing therein.

companyName: DocGo Inc.

ticker: DCGO


text: These processes are managed and monitored by a dedicated information technology team, which is led by our Chief Technology Officer ("CTO"), and include mechanisms, controls, technologies, systems and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits and ongoing risk assessments, including due diligence on and audits of our key technology vendors and other contractors and suppliers. We also conduct regular employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends and their impact on the Company's risk environment. We also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information.


text: With respect to incident response, we have adopted a Cybersecurity Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the National Institute of Standards and Technology framework and focuses on four phases: • preparation and prevention; • detection and analysis; • containment, eradication and recovery; and • post-incident remediation.


text: The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Despite ongoing efforts to continually improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions and statutory penalties, among other consequences. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. However, there can be no guarantee that we will not be the subject of future successful cybersecurity attacks, threats or incidents that materially affect our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Information Technology."


text: Our CTO, who reports directly to our Chief Executive Officer, is responsible for assessing and managing cybersecurity risks. Our CTO has gained substantial information technology and cybersecurity knowledge from over 25 years of work experience at the Company and elsewhere. Our CTO receives reports on cybersecurity threats from our dedicated information technology team on an ongoing basis and, in conjunction with management, regularly review risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CTO also works closely with our legal and compliance departments to oversee compliance with legal, regulatory and contractual security requirements.


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks. The Board's Audit and Compliance Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit and Compliance Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our CTO, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives updates from management and the Audit and Compliance Committee on cybersecurity risks on at least an annual basis. In addition, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Board and Audit and Compliance Committee.


text: These processes are managed and monitored by a dedicated information technology team, led by our Chief Information Security Officer ("CISO"), who also serves as our Chief Information Officer, and include mechanisms, controls, technologies, systems and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits and ongoing risk assessments, including due diligence on and audits of our key technology vendors and other contractors and suppliers. We also conduct regular employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends and their impact on the Company's risk environment. We also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information.


text: Despite ongoing efforts to continually improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions and statutory penalties, among other consequences. Based on the information available as of the date of this Annual Report, we believe that risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and as of the date of this Annual Report, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, there can be no guarantee that we will not be the subject of future cybersecurity attacks, threats or incidents that may materially affect our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Information Technology."


text: Our CISO, who reports to our Chief Financial Officer, is responsible for assessing and managing cybersecurity risks. Our CISO has over 20 years of experience in cybersecurity, risk management and information security governance and holds Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications. Our CISO receives reports on cybersecurity threats from our dedicated information technology team on an ongoing basis and, in conjunction with management, regularly review risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO also works closely with our legal and compliance departments to oversee compliance with legal, regulatory and contractual security requirements.


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks. The Board's Audit and Compliance Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit and Compliance Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our CISO, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives updates from management and the Audit and Compliance Committee on cybersecurity risks on at least an annual basis. In addition, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Board and Audit and Compliance Committee.


text: We rely on information technology ("IT") systems to conduct business, including but not limited to, interacting with customers and suppliers, fulfilling orders, generating invoices, collecting and making payments, fulfilling contractual obligations, communicating with internal and external stakeholders, and maintaining our business and financial records. In addition, we rely on networks and services, including internet sites, cloud and software-as-a-service solutions, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms, some of which are managed, hosted, provided and/or used by third-parties or their vendors. As a result, the Company is subject to various risks related to vulnerabilities, threats and attacks on these IT systems. See Item 1A, "Risks Related to the Company – "Our business may be subject to system interruptions, cyber security breaches and unauthorized data disclosures." under Item 1A. Risk Factors for additional discussion of these risks.

companyName: Sotera Health Co

ticker: SHC


text: Identifying and assessing cybersecurity risk is fully integrated into our overall risk management systems and processes. The Company is committed to developing and maintaining cybersecurity processes that protect the confidentiality, integrity and availability of Company, employee, customer and partner information against a growing number of increasingly sophisticated cybersecurity threats and threat actors. Our cybersecurity program is designed to protect our infrastructure from potential threats, to allow us to assess, identify and manage material risks from cybersecurity threats and to endeavor to secure the integrity of our data systems using techniques, hardware, and software typical of companies of our size and scope, which are described further below. For example, we leverage the National Institute of Standards and Technology Cybersecurity Framework's ("NIST CSF") principles in developing our cybersecurity program to monitor our security environment and manage risk.


text: The Company has adopted a risk-based strategy designed to achieve a targeted and cost-effective approach to managing cybersecurity risks that strengthens our abilities to prevent, detect, and respond to cyber-attacks, breaches, or threats. The Company has configured its IT environment, where possible, to restrict access using a least privileged methodology. We use various technologies and monitoring capabilities to detect anomalies and track information and assets. We have implemented a cybersecurity awareness program consisting of frequent training, phishing exercises, and bulletins regarding pertinent cybersecurity developments. We maintain and regularly update incident response, disaster recovery and business continuity plans and procedures. Our IT specialists subscribe to threat intelligence feeds and are members of cybersecurity-related associations such as the Information Systems Audit and Control Association, the Computing Technology Industry Association and the Cloud Security Alliance. We also retain independent experts to assess our cybersecurity programs and the potential vulnerabilities of our IT systems to unauthorized access and other intrusions. We also maintain insurance coverage for cyber and data security risks of an amount and subject to conditions and exceptions that we believe are customary for companies like ours, but there can be no assurance that our levels of coverage are adequate or that we will be able to continue to maintain our existing insurance or obtain comparable insurance at a reasonable cost.


text: Although we believe that our resiliency planning and security controls are appropriate to our exposures to system outages, service interruptions, security incidents and breaches, our information technology systems remain vulnerable to attacks by increasingly sophisticated actors who attempt to cause harm to, or otherwise interfere with, the normal use of our systems. Like other companies with international operations, we have been subjected to targeted and non-targeted attacks and other cyber incidents and continue to face numerous cybersecurity threats on a regular basis, including regular attempts to penetrate our information technology infrastructure and breaches of our security systems by our employees, both accidental and intentional. Our suppliers, contractors, service providers, and other third parties with whom we do business also experience cyber threats and attacks that are similar in frequency and sophistication. Moreover, in many cases, the Company relies on controls put in place by our suppliers, contractors, service providers, and other third parties to defend against and otherwise respond to cyber threats and attacks, which may prove insufficient.


text: Our technology systems and infrastructure are also potentially vulnerable to computer viruses, breakdowns or other interruptions caused by fires, natural disasters, losses of power, system malfunctions or other disruptions. IT security breaches by third parties who are able to penetrate our systems without authorization or data privacy breaches by employees or others with authorized access pose the risk that sensitive data may be exposed to unauthorized persons or the public, rendered inaccessible or permanently lost. The increasing use and evolution of technology creates additional opportunities for the intentional or unintentional dissemination or destruction of confidential or proprietary information stored in our systems or portable media or storage devices. We may also experience business interruptions (including, but not limited to, the partial or complete shutdown of one or more of our facilities), thefts of information or reputational damage from industrial or nation-state espionage attacks, ransomware, other malware or other cyber incidents or data breaches, which may compromise our system infrastructure or lead to data breaches, either internally or at our third-party providers or other business partners. Such incidents could compromise our trade secrets or other confidential information and result in such information being disclosed to third parties and becoming less valuable. Additionally, many of our employees continue to work remotely either part-time or full-time, which may increase the risk of data breaches or other types of cyber incidents.


text: The Company has not experienced any material cybersecurity incidents that caused us to incur any material expenses or materially affected our business, results of operations or financial condition, but we cannot assure that our business, results of operations and financial condition will not be materially affected in the future by cybersecurity risks or future incidents. Breaches in IT security, system interruptions and unauthorized disclosures of data, whether perceived or actual, could adversely affect our business, assets, revenues, results of operations, brands and reputation and result in fines, litigation, regulatory proceedings and investigations, increased insurance premiums, remediation efforts, indemnification expenditures, lost revenues and other potential liabilities. Although we have taken and will continue to take significant steps to protect the security and integrity of our information and although we have implemented policies and procedures to enhance data privacy and security, there can be no assurance that our efforts will prevent breakdowns, system failures, breaches of our systems or other cyber incidents or otherwise be fully effective. Any such breakdown, breach or incident could adversely affect our business, prospects, financial condition or results of operations, and any insurance that we may have for cyber incidents may not cover such risks or be sufficient to compensate us for losses that may occur.


text: Our Chief Information Officer ("CIO") is responsible for assessing and managing cybersecurity risks in collaboration with the Senior Director of IT Governance, Service Delivery and the Senior Director of Global Infrastructure, and Senior Information Security Architect, who manage our day-to-day cybersecurity-related matters and keep abreast of cybersecurity news, events and incidents through regular course monitoring and updates. These individuals average over 25 years of professional experience in various roles across multiple industries involving managing information security, developing cyber security strategy, implementing cybersecurity programs, and managing multiple industry and regulatory compliance environments (including over 15 years of collective experience working for public companies in similar roles prior to joining the Company). Our Senior Information Security Architect has several information technology-related certifications, including as a Certified Information Systems Security Professional ("CISSP").


text: When detected, suspected cybersecurity threats are escalated to the CIO and incident response team. The CIO then creates a Cybersecurity Incident Response Team ("CSIRT") which, depending on the incident, comprises the incident coordinator, cybersecurity staff, legal counsel and other stakeholders as appropriate. The CSIRT investigates and manages the impact of cybersecurity incidents in accordance with our security incident response procedures. The incident response plan provides for our CIO and our CIO's team to work closely with our Chief Financial Officer, General Counsel and other key stakeholders, as appropriate, to assess the materiality of the incident and any impact to the Company's operations or financial position. Pursuant to the incident response plan and the Company's Disclosure Controls and Procedures, potentially material cyber incidents are escalated to the Company's Disclosure Committee to evaluate, in consultation with the Chair of the Audit Committee of our Board of Directors as needed, whether an incident is required to be reported on a Form 8-K.


text: Our Board and the Board's Audit Committee oversee the Company's enterprise risk management ("ERM") program, including the Company's assessments of cybersecurity risks and exposures and the Company's processes to safeguard assets and manage material cybersecurity risks. On an annual basis, the Board reviews the Company's principal current and future risk exposures, including cybersecurity risks and exposures. The Audit Committee bears principal responsibility for overseeing the Company's major financial risk and enterprise exposures and the steps management has taken to monitor and control such exposures, including an annual session with our CIO on the Company's procedures and policies for assessing and managing cybersecurity risks and disclosing any material cybersecurity incidents. In performing these oversight functions, the Board and Audit Committee rely on advice, reports and opinions of management, counsel and our internal and external auditors, including mid-year and year-end cyber inquiries by our external auditors on various aspects of the Company's cybersecurity program, processes and training.


text: Use of Independent Experts The Company engaged an independent expert to conduct annual external and internal penetration tests beginning in the fourth quarter of 2021 and to assess our cybersecurity program against the NIST CSF in late 2022. We plan to continue to engage independent experts to periodically test our cybersecurity policies for their effectiveness.


text: We rely on IT systems to conduct business, including but not limited to, interacting with customers and suppliers, fulfilling orders, generating invoices, collecting and making payments, fulfilling contractual obligations, communicating with internal and external stakeholders, and maintaining our business and financial records. In addition, we rely on networks and services, including internet sites, cloud and software-as-a-service solutions, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms, some of which are managed, hosted, provided and/or used by third-parties or their vendors. As a result, the Company is subject to various risks related to vulnerabilities, threats and attacks on these IT systems. See Item 1A, "Risks Related to the Company–"Our business may be subject to system interruptions, cybersecurity incidents and unauthorized data disclosures." under Item 1A. Risk Factors for additional discussion of these risks.


text: The Company has an enterprise risk management ("ERM") program that includes the processes used to identify assess, and manage our most significant enterprise risks and uncertainties that could materially impact the long-term health of the Company or prevent the achievement of strategic objectives. These risks are identified, measured, monitored, and managed across key risk categories, which include the consideration of cybersecurity risks. The Company develops and maintains cybersecurity processes that protect the confidentiality, integrity and availability of Company, employee, customer and partner information against a growing number of cybersecurity threats and threat actors. Our cybersecurity program is designed to protect our infrastructure from potential threats, including threats associated with our third party business partners, to allow us to assess, identify and manage material risks from cybersecurity threats and to endeavor to secure the integrity of our data and IT systems using techniques, hardware, and software typical of companies of our size and scope, which are described further below. For example, we leverage the National Institute of Standards and Technology Cybersecurity Framework's ("NIST CSF") principles in developing our cybersecurity program to monitor our security environment and manage risk. However, this does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks and threats relevant to our business.


text: The Company has adopted a risk-based strategy designed to achieve a targeted and cost-effective approach to managing cybersecurity risks that strengthens our abilities to prevent, detect, and respond to cybersecurity incidents. The Company has configured its IT environment, where possible, to restrict access using a least privileged methodology. We use various technologies and monitoring capabilities to detect anomalies and track information and assets. We have implemented a cybersecurity awareness program consisting of frequent training, phishing exercises, and bulletins regarding pertinent cybersecurity developments. We maintain and regularly update incident response, disaster recovery and business continuity plans and procedures. Our IT specialists subscribe to threat intelligence feeds and are members of cybersecurity-related associations such as the Information Systems Audit and Control Association, the Computing Technology Industry Association and the Cloud Security Alliance. We also maintain insurance coverage for cyber and data security risks of an amount and subject to conditions and exceptions that we believe are customary for companies like ours, but there can be no assurance that our levels of coverage are adequate or that we will be able to continue to maintain our existing insurance or obtain comparable insurance at a reasonable cost or at all.


text: As of the date of this filing, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents have had, or are reasonably likely to have, a material effect on our business strategy, results of operations or financial condition, but we cannot assure that our business strategy, results of operations and financial condition will not be materially affected in the future by cybersecurity risks or future cybersecurity incidents. Although we have taken and will continue to take significant steps to protect the security and integrity of our information and although we have implemented policies and procedures to enhance data privacy and security, there can be no assurance that our efforts will prevent breakdowns, system failures, breaches of our systems or other cybersecurity incidents or otherwise be fully effective. Any such breakdown, breach or cybersecurity incident could adversely affect our business strategy, prospects, financial condition or results of operations, and any insurance that we may have for cybersecurity incidents may not cover such risks or be sufficient to compensate us for losses that may occur.


text: Our Chief Information Officer ("CIO") is responsible for assessing and managing cybersecurity risks. The CIO is supported by the Senior Director of IT Governance, Security, and Service Delivery and the Senior Director of Global Infrastructure, and Senior Information Security Architect, who manage our day-to-day cybersecurity-related matters and keep abreast of cybersecurity news, events and incidents through regular course monitoring and updates. Our CIO has over 12 years of professional experience in various roles involving managing information security, developing cybersecurity strategy, implementing cybersecurity programs, and managing multiple industry and regulatory compliance environments. Our CIO also holds a certificate in Cyber-Risk Oversight issued by the National Association of Corporate Directors. Our Senior Director of IT Governance, Security, and Service Delivery has over 15 years of professional experience in various roles involving managing information security, developing cybersecurity strategy, implementing cybersecurity programs, and managing industry and regulatory compliance environments. Our Senior Information Security Architect has over 20 years of professional experience designing secure architecture, conducting threat and risk assessments, incident response, cyber forensics, and teaching college and university level cybersecurity program courses. Our Senior Information Security Architect also holds a diverse set of certifications, including CISSP, CISCO Security +, CISA, CEH, CompTIA Sec +, and others.


text: When detected, suspected cybersecurity threats are escalated to the CIO and incident response team. The CIO then creates a Cybersecurity Incident Response Team ("CSIRT") which, depending on the incident, comprises the incident coordinator, cybersecurity staff, legal counsel and other stakeholders as appropriate. The CSIRT investigates and manages the impact of cybersecurity incidents in accordance with our security incident response procedures.


text: Our board of directors and its audit committee oversee the Company's ERM program, and the steps management has taken to monitor and mitigate such risks, including the Company's procedures and any related policies with respect to enterprise risk assessment and risk management. The board of directors bears principal responsibility for overseeing the Company's principal current and future risk exposures, and, on an annual basis, the board of directors reviews them, including cybersecurity risks and exposures. The board of directors' review includes an annual session with our CIO on the Company's procedures and policies for assessing and managing cybersecurity risks and disclosing any material cybersecurity incidents. In performing these oversight functions, the board of directors relies on advice, reports and opinions of management, counsel and our internal and external auditors, including mid-year and year-end cybersecurity inquiries by our external auditors on various aspects of the Company's cybersecurity program, processes and training.


text: Use of Independent Experts The Company engages external resources in connection with our processes for assessing, identifying and managing material risks from cybersecurity threats. These resources include, but are not limited to, regular internal and external penetration tests and assessments of our cybersecurity program by third-party experts. We plan to continue to engage independent experts to periodically test our cybersecurity policies for their effectiveness.


text: The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying and managing material risks from cybersecurity threats and responding to cybersecurity incidents are part of the Company's overall risk assessment efforts. The Company has established controls and procedures, including an incidence response plan, that provide for the identification, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. The Company continues to review its Cybersecurity program and controls and procedures as part of its efforts to strengthen its defenses.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: As part of its cybersecurity program, the Company utilizes firewalls, identity and access management programs, email security, anti-malware, and a detection and response program. The Company periodically assesses and tests its policies, standards, processes and practices that are designed to address cybersecurity threats and incidents by performing internal and external vulnerability scans, penetration testing, and phishing exercises. The Company utilizes a combination of internal employees and third parties to perform security monitoring and 24/7 response, penetration testing, phishing campaigns, and provide security awareness training to our employees. We recently updated our onboarding process for certain third-party vendors and service providers to include a review and assessment of their information security practices. The Company also conducts information security and awareness training to ensure that employees are aware of information security risks and to enable them to take steps to mitigate those risks.


text: Role of the Board The Board is responsible for cybersecurity risk oversight and receives periodic updates from management on the Company's cybersecurity program, threats, and defense measures implemented. Additionally, our Chief Technology Officer ("CTO") provides updates to the Board on an as needed basis with respect to cybersecurity risks or any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such cybersecurity incident until it has been remediated.


text: Role of Management Our CTO oversees and provides accountability related to our cybersecurity risk management strategy and overall information security program. The CTO's cybersecurity team is led by a Director of Information Technology Security. The cybersecurity team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The program incorporates policies and practices designed to protect the privacy and security of our sensitive information.


text: The cybersecurity team includes dedicated internal resources that currently have Certified Information Systems Security Professional ("CISSP") credentials, Certificate of Cloud Security Knowledge ("CCSK"), and other security and network certifications. In addition to our internal security staff, we partner with various third-party security service providers to augment our staffing, expertise, and hours of operation.


text: The CTO regularly reports to our senior leadership team, as well as periodically to our Board of Directors, regarding our cybersecurity program and material cybersecurity risks. The CTO coordinates with other teams including internal Audit, to ensure a combined focus on technology modernization and remediation needs. The CTO is briefed weekly on current security operations and relevant issues across the cybersecurity threat landscape.


text: Current Cybersecurity events In late May 2023, we experienced a ransomware attack relating to certain systems on our network (the "Cybersecurity Incident"). We promptly initiated an investigation, engaged the services of cyber-security experts and outside advisors and worked with appropriate law enforcement authorities to contain, assess and remediate the Cybersecurity Incident.


text: The Cybersecurity Incident affected certain of our information technology systems, and as part of the containment effort, we suspended affected systems and elected to temporarily suspend additional systems in an abundance of caution. We reactivated and restored our operational systems over the course of the week following the Cybersecurity Incident. The Cybersecurity Incident related costs net of an expected insurance receivable totaled $1.0 million. Our system remediation efforts regarding the Cybersecurity Incident have substantially concluded as of December 30, 2023.


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. In the event of an attack or other intrusion, we have a response team of internal and external resources engaged and prepared to respond. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues. We plan to continually invest in efforts to enhance data security in response to developments in the cybersecurity landscape.


text: Role of the Board of Directors The Audit Committee and the Board of Directors are responsible for the oversight of cybersecurity risk. The Audit Committee and Board of Directors receive periodic updates from management on the Company's cybersecurity program, threats, and defense measures implemented. Additionally, our Senior Vice President of Information Technology ("SVP - IT") provides updates to the Board of Directors on an as needed basis with respect to cybersecurity risks or any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such cybersecurity incident until it has been remediated.


text: Role of Management Our SVP-IT oversees and provides accountability related to our cybersecurity risk management strategy and overall information security program. The SVP-IT's cybersecurity team is led by a Director of Information Technology Security. The cybersecurity team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The program incorporates policies and practices designed to protect the privacy and security of our sensitive information.


text: The cybersecurity team leverages tools and systems such as Security Information and Event Management ("SIEM"), for real time alerts and insights.


text: The SVP-IT regularly reports to our senior leadership team, as well as periodically to our Board of Directors, regarding our cybersecurity program and material cybersecurity risks. The SVP-IT coordinates with other teams including internal Audit, to ensure a combined focus on technology modernization and remediation needs. The SVP-IT is briefed weekly on current security operations and relevant issues across the cybersecurity threat landscape.


text: Current Cybersecurity Events In late May 2023, we experienced a ransomware attack relating to certain systems on our network (the "Cybersecurity Incident"). We promptly initiated an investigation, engaged the services of cybersecurity experts and outside advisors and worked with appropriate law enforcement authorities to contain, assess and remediate the Cybersecurity Incident.


text: The Cybersecurity Incident affected certain of our information technology systems, and as part of the containment effort, we suspended affected systems and elected to temporarily suspend additional systems in an abundance of caution. We reactivated and restored our operational systems over the course of the week following the Cybersecurity Incident. In 2023, the Cybersecurity Incident related costs net of an expected insurance receivable totaled $1.0 million. Our system remediation efforts regarding the Cybersecurity Incident were concluded as of December 30, 2023. In the fourth quarter of 2024, we received proceeds from our insurance claim that exceeded the amount recorded as a receivable by $0.6 million. These proceeds represented the cost associated with lost revenue and incremental expenses incurred.


text: The Company has no employees and is externally managed by our Manager. Pursuant to the terms of the Management Agreement, our Manager manages, operates and administers our day-to-day operations, business and affairs, subject to the direction and supervision of the Board. The Board recognizes the critical importance of maintaining the trust and confidence of our business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. The Company and our Manager are committed to protecting the confidentiality of all nonpublic information related to the Company's borrowers, shareholders and their personnel.

companyName: Advanced Flower Capital Inc.

ticker: AFCG


text: As an externally managed company, the Company relies on our Manager's corporate information technology, accounting and financial reporting platforms, enterprise applications and related systems (our "Information Systems") in connection with the Company's day-to-day operations. Our Manager has adopted a written information security program (the "Written Information Security Policy"), which is designed to address applicable requirements under Regulation S-P and the FTC Safeguards Rule. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats under the Manager's Written Information Security Policy. The processes include, among other things, maintaining secure digital or physical access to information assets, using manual and automated detection methods for malicious code, due diligence of third-party vendors, and engaging a leading provider of cybersecurity services to assess and manage cybersecurity risk. For third-party service vendors that perform a variety of important functions for our business, we seek to engage reliable, reputable service vendors that maintain cybersecurity programs.


text: All of the Company's officers and employees are employees of the Manager and subject to its policies and procedures. Our Manager utilizes a third-party managed & cybersecurity services provider (the "MSSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our Manager and the MSSP engage in periodic assessment and training regarding the policies, standards and practices designed to address cybersecurity threats and incidents. Our cybersecurity risk management is integrated into our overall enterprise risk management and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management To date, we have not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company and we are not aware of any cybersecurity threats that are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Risk Factors—General Risk Factors—We rely on information technology in our operations, and security breaches and other disruptions in our systems could compromise our information and expose us to liability, which would cause our business and reputation to suffer."


text: The Company's Audit and Valuation Committee oversees the Company's cybersecurity risk management process. The Audit and Valuation Committee has adopted a charter that provides that the Audit and Valuation Committee must periodically review and discuss with the Company's management team the Company's guidelines and policies with respect to risk assessment and risk management of cybersecurity and other risk exposures relevant to the Company's computerized information system controls and security. The Audit and Valuation Committee may receive additional training in cybersecurity and data privacy matters to enable its oversight of such risks. The Audit and Valuation Committee will report to the Board on the substance of such reviews and discussions and, as necessary, recommend to the Board such actions as the Audit and Valuation Committee deems appropriate.


text: As noted above, the Company relies on our Manager's Information Systems in connection with the Company's day-to-day operations. The Company relies on the MSSP's processes for assessing, identifying, and managing material risks from cybersecurity threats.


text: The Company's Chief Financial Officer and Treasurer, Chief Legal Officer and Secretary, and Head of IT work collaboratively with other employees of our Manager and the MSSP to ensure the MSSP's services protect the Company's Information Systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. These members of the Company's management team, together with the MSSP, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Audit and Valuation Committee when appropriate. These members of the Company's management team meet periodically to assess cybersecurity risks and discuss with the Audit and Valuation Committee. They have gained relevant knowledge, skills and experience in information technology and cybersecurity risk management, including overseeing third-party vendors in such areas, over their careers at the Company or other organizations.


text: As an externally managed company, the Company relies on our Manager's corporate information technology, accounting and financial reporting platforms, enterprise applications and related systems (the "Information Systems") in connection with the Company's day-to-day operations. Our Manager has adopted a written information security program (the "Written Information Security Policy"), which is designed to address applicable requirements under Regulation S-P and the FTC Safeguards Rule. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats under the Manager's Written Information Security Policy. The processes include, among other things, maintaining secure digital or physical access to information assets, using manual and automated detection methods for malicious code, due diligence of third-party vendors, and engaging a leading provider of cybersecurity services to assess and manage cybersecurity risk. For third-party service vendors that perform a variety of important functions for our business, we seek to engage reliable, reputable service vendors that maintain cybersecurity programs.