text: We also identify our cybersecurity threat risks by comparing our processes to standards established by HITRUST and SOC2 frameworks and any findings resulting from penetration testing and threat modeling conducted by third party service providers. To provide for the confidentiality, integrity, and availability of critical data and information systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following internal security measures: • maintain a cybersecurity program through formally-defined documented policies, standards, processes, and procedures to ensure internal security measures are implemented to protect against cybersecurity threats, to assess emerging cybersecurity and data privacy laws, and to implement changes to our processes that are designed to comply with laws applicable to our organization; • implement policies and procedures to identity organizational assets, data and critical IT systems, assess (and periodically re-assess) those assets, data, and systems for cybersecurity risks, and to develop management plans for identifying and remediating identified risks; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to handle confidential data and systems in a legally compliant and acceptable manner; • employ technical security tools that are designed to protect our critical data and information systems from cybersecurity threats, including network firewalls and access controls, vulnerability scanners, intrusion prevention and detection systems, anti-malware/endpoint protection systems, and identity and access management systems which are evaluated for effectiveness and improved through vulnerability assessments and cybersecurity threat intelligence; • provide quarterly, mandatory training for our employees regarding cybersecurity threats to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • implement administrative processes and procedures to define acceptable security parameters and baselines of IT assets and information systems, and utilize access controls to prevent unauthorized alterations to system parameters and to maintain oversight over configuration changes and modifications to those systems; • conduct third party security reviews of critical and high-risk third-party suppliers and vendors; • conduct quarterly phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • run annual tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • implement a formal Incident Response Plan, based upon NIST, HITRUST, and SOC2 frameworks, to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident, which Incident Response Plan includes processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation; and • carry information security risk insurance to insure against potential losses arising from a cybersecurity incident.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having a third-party independent Risk Assessor review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: Hyperfine, Inc.

ticker: HYPR

secItem: Item 1C


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers, manufacturers and other third parties who have access to patient and employee data or our IT systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and we continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading under Risk Factors titled "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation", which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and any expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. As needed, we will contract a professional cybersecurity investigation firm to conduct a full forensic analysis of any suspected material incident. To date, we have concluded that there has not been any evidence of material concern involving malware, persistence mechanisms or other compromised exchange of on-premises accounts within the Company's environment.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our audit committee generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager. Such individuals have collectively over 50 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Our audit committee is also designated to receive prompt and timely information regarding any material cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: AGENUS INC

ticker: AGEN


text: We design and assess our program based on the Information Systems Audit and Control Association's Control Objectives for Information Technologies framework and National Institute of Standards and Technology cybersecurity framework, as well as threat trends identified by multiple external and internal cybersecurity intelligence reports.


text: Our cybersecurity risk management program is aligned to our business strategy and has been incorporated into our enterprise risk management process.


text: We contract with external firms to assess our cybersecurity controls. We have processes in place to identify and evaluate risks associated with third party vendors and suppliers. In addition, we have systems in place to maintain business continuity and disaster recovery. To date, we have not experienced any material cybersecurity incidents.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to affect our business, results of operations and financial condition, under the heading "Our internal computer systems, or those of our third-party CROs, CMOs, licensees, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption in our business and operations or could subject us to sanctions and penalties that could have a material adverse effect on our reputation or financial condition. " included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which is incorporated by reference into this Item 1C.


text: Our Audit Committee of the Board of Directors has oversight responsibility for risks and incidents related to cybersecurity threats. Our Chief Information Officer is a member of our Enterprise Risk Management Committee and provides the Audit Committee and the Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.


text: Our team of cybersecurity professionals is led by our Chief Information Officer, who has over 20 years of experience in cybersecurity in regulated industries. Our cybersecurity team monitors the prevention and detection of cybersecurity events and is responsible for incident response and remediation.


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to ensure the security of our information systems and networks and the confidentiality, availability, and integrity of our data.

companyName: Turtle Beach Corp

ticker: TBCH


text: Risk management and strategy Turtle Beach uses a risk-based approach to cybersecurity, utilizing industry-standard frameworks and methodologies to assess and manage risks. The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes have been integrated into the Company's overall risk management processes and include an incident response plan to assess and remediate cybersecurity attacks.


text: The incident response plan provides guidance in identifying, assessing, investigating, remediating, and reporting any confirmed or suspected: (i) compromise of physical, network or system security; (ii) unauthorized access or acquisition of personal information or proprietary information; or (iii) material noncompliance with Company information privacy and security policies and procedures. The plan and associated processes have flexibility to ensure a tailored response based on the circumstances of the incident.


text: From time to time, the Company engages third party experts to assess the Company's cybersecurity controls and processes. For example, in 2021, the Company engaged an information security consultant to conduct and external, design-focused assessment using the National Institute of Standards and Technology framework to evaluate the Company's cybersecurity controls. The Company's management used the assessment to assist them in evaluating the Company's cybersecurity controls, and its Company's policies and procedures to further align them with industry standards.


text: The Company also has processes to identify and oversee cybersecurity threats associated with its use of third-party service providers. These processes include diligence of third-party cybersecurity risk through SOC-2 audits and use of independent vendors who provide cybersecurity ratings. In addition, the Company maintains an insurance policy which specifically provides coverage for qualifying information security breaches.


text: The Company has not experienced a material information security breach in the last five years, nor has it incurred any expenses or penalties or paid any settlements related thereto. The Company is not currently facing any cybersecurity threats reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition.


text: Cybersecurity is an important part of the Board's risk oversight. Although the full Board retains responsibility for cybersecurity oversight, the Audit Committee of the Board (the "Audit Committee") has authority to immediately assess and manage a cybersecurity incident if one were to occur. The Company's senior management briefs the Audit Committee and the Board periodically on cybersecurity matters and would promptly brief the Audit Committee if a cybersecurity incident occurred.


text: The Company's management has day-to-day responsibility for managing cybersecurity risks. The management team includes our Chief Financial Officer, who has cybersecurity expertise through prior leadership positions in networking and software businesses, and our Senior Director of Information Technology, who has formal data security training and certifications. In addition to using industry-standard tools to monitor cybersecurity risks, management receives direct reporting of cybersecurity threats from our employees, who are trained annually on cyber security risks and reporting.


text: We have established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: Identiv, Inc.

ticker: INVE


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize using tools such as a SIEM (Network and Cloud Platform Log Collector), Network Vulnerability Scanner, and other utilities for monitoring all Company assets. We conduct these risk assessments directly and also engage security product platform support teams as needed.


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate members of our management team, including our executive staff, information technology ("IT") team, and Global Director of IT who reports to our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), to manage the risk assessment and mitigation process. As part of our overall risk management, we collaborate cross-functionally to monitor and test our safeguards and to train our employees on cybersecurity risks and safeguards. We offer cybersecurity training programs for employees at all levels and departments.


text: We require appropriate third-party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our Company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such threats or incidents in the future. Like any technology provider, we have experienced cybersecurity incidents in the past which were remediated on a case-by-case basis. See "Risk Factors" for more information on our cybersecurity risks.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing our strategic risk exposure with respect to cybersecurity risks and the audit committee of our board of directors oversees management of such risks. Our executive officers, including our CEO and CFO, are responsible for day-to-day management of the material risks we face.


text: Our Global Director of IT, in coordination with our executive officers, including our CEO and CFO, are responsible for assessing and managing material risks from cybersecurity threats, as well as managing and responding to material cybersecurity incidents if any occur. Our Global Director of IT has over 30 years of experience in various information technology roles, which experience includes management of cybersecurity matters, including over 20 years of experience as an IT Director. Our CFO has over 10 years of experience in risk management at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Our Global Director of IT provides weekly briefings to the CEO and CFO about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In the event threats and incidents are identified as potentially significant, the CEO and CFO will promptly report to our audit committee. Our Global Director of IT also provides periodic updates to the audit committee on the Company's cybersecurity policies and processes, material cybersecurity risks and mitigation strategies, and the audit committee provides periodic reports to the board of directors on such matters.


text: As an externally managed BDC, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Investment Adviser, an indirect subsidiary of AGM. AGM determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by AGM, and we rely on AGM for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: MidCap Apollo Institutional Private Lending


text: AGM's Board of Directors is involved in overseeing AGM's risk management program, including with respect to cybersecurity, which is a critical component of AGM's overall approach to enterprise risk management ("ERM"). AGM's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are, in part, based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of AGM's overall ERM approach, AGM's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," AGM's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of AGM's risks, including its cybersecurity risks. AGM's Chief Information Security Officer ("CISO") and the Chief Information Security Officer of Athene Holding Ltd. ("AHL's CISO"), a subsidiary of AGM, with support from the broader AGM Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Investment Adviser and its affiliates. • Collaborative Approach. AGM utilizes a cross-functional approach involving stakeholders across multiple departments, including AGM Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our Board, as applicable, in a timely manner. • Technical Safeguards. AGM deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. AGM has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. AGM maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. AGM provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: AGM engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. AGM regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to AGM's risk management function, and AGM adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Cybersecurity Governance AGM's Board of Directors' oversight of cybersecurity risk management is supported by the audit committee of AGM's Board of Directors ("AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. AGM's Board of Directors, AGM's audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on AGM's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from AGM's risk management professionals, AGM's Chief Security Officer ("CSO"), the CISO, the AHL CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from AGM's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's Board of Directors and/or AGM's audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM Board of Directors or AGM's audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually.


text: AGM's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM's CISO for nearly eight years. AGM's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: AGM's CISO, in coordination with the AGM Technology and ERM teams, works collaboratively across AGM to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of AGM's cybersecurity risk management program, multidisciplinary teams throughout AGM are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to AGM's audit committee or AGM's Board of Directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board, our audit committee regularly interacts with, and receives reports from, our management, the Investment Adviser, AGM, and other service providers. The audit committee of our Board receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to AGM's peers and third parties. Additionally, AGM and other service providers periodically report to management as it relates to our cybersecurity practices.


text: AGM's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Investment Adviser, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Investment Adviser and AGM), including risk mitigation, compliance and controls.


text: Risk Governance and Oversight Cybersecurity represents an important component of the Company's overall cross-functional approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management (ERM) approach, and cybersecurity risks are among the core enterprise risks identified for oversight by the Board through our annual ERM assessment. While the Board is ultimately responsible for risk oversight, the Audit Committee oversees the overall review of our policies and procedures with respect to risk assessment and risk management, and has oversight of information technology and security matters, which includes cybersecurity strategies and risks, as well as data privacy and data protection (Information Security). The Audit Committee oversees the management of risks from cybersecurity threats, including the policies, processes, and practices that the Company's management implements to address risks from cybersecurity threats.

companyName: Burlington Stores, Inc.

ticker: BURL


text: On a quarterly basis, our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) report to the Audit Committee on our Information Security program, including presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, security initiatives, vulnerability assessments, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and vendors; recent cybersecurity-related developments; strategic activities; and the execution of our cybersecurity awareness training. In turn, the chair of the Audit Committee reports out to the full Board on a quarterly basis regarding these matters, among other matters addressed by the Audit Committee.


text: Management utilizes a cross-functional approach designed to address the risk from cybersecurity threats, involving senior management personnel from the technology, operations, legal, risk management, internal audit and other key business functions, as well as members of the Company's Board and the Audit Committee of the Board. The Company's CIO, with support from our CISO and the other members of the cybersecurity team, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program.


text: The CIO, in coordination with the CISO, works to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. To facilitate the success of this program, the cybersecurity team works to address cybersecurity threats and respond to cybersecurity incidents in accordance with the Company's written incident response plan. The CISO and cybersecurity team regularly meet to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and the CISO consults with the CIO and executive management, including the Chief Executive Officer, to report such incidents to the Audit Committee and the Board and initiate a response to incidents when appropriate.


text: We believe our cybersecurity team, led by our CISO, has the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats. Our CISO is a credentialed and industry-recognized security executive with over 20 years' experience in healthcare, government and the private sector implementing enterprise cybersecurity and privacy programs, building high performing teams, creating a risk-aware culture, managing cybersecurity incidents, and communicating cyber risks to boards of directors. He holds a Master degree in Computer Engineering and has obtained certifications, including Certified Information Security Manager and Certified Information Systems Security Professional. Prior to joining Burlington, the CISO served as the CISO at Hospital for Special Surgery for 6 years and as a CISO at NYC Health+Hospitals for 4 years. Our CISO reports to our CIO, who has more than 25 years of information technology leadership experience. Together our CIO and CISO have decades of leadership experience in information technology, cybersecurity and retail.


text: We have created a cybersecurity program that endeavors to prevent, detect, contain and respond to material risks from cybersecurity threats and incidents and integrate cybersecurity risk into our enterprise risk management framework and activities. Our program consists of policies and procedures for identification, assessment, remediation, response, and reporting of cybersecurity threats and incidents. The cybersecurity program is a part of our company's ERM framework and activities. The cybersecurity program employs a risk-based approach and draws upon a combination of industry standard frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Payment Card Industry Data Security Standard (PCI DSS).


text: Our cybersecurity risk management approach and processes are designed to manage risks from cybersecurity threats associated with our use of third-party service providers, ranging from vendor cyber vetting to conducting security assessments and monitoring activities. We also operate an employee awareness and training program to help ensure all relevant associates are equipped to recognize and respond to potential threats. Additionally, we leverage threat intelligence technologies to inform our response posture to potential emerging threats to our digital business infrastructure and systems. Furthermore, we engage with third-party cybersecurity consultants and technology vendors to assess our cybersecurity program and test our technical capabilities. The Company also carries information security risk insurance that is designed to mitigate against certain potential losses arising from a cybersecurity incident.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. As further discussed in Item 1A, Risk Factors, if we are unable to protect our information systems against service interruption, misappropriation of data, breaches of security, or other cyber-related attacks, our operations could be disrupted, we may suffer financial losses and our reputation may be damaged.


text: We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner.

companyName: PROKIDNEY CORP.

ticker: PROK


text: Cybersecurity risks related to our business, manufacturing operations, clinical trials, privacy and compliance issues are identified and addressed through third party assessments, internal IT audits, IT security, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents we conduct proactive cybersecurity reviews of systems and applications, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: We have implemented incident response and breach management processes which are based on the National Institute of Standards and Technology (NIST) framework for incident response. This includes 1) defined roles and incident response initiation processes, 2) incident detection and analysis, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses and related matters of cybersecurity are overseen by leaders from our Information Technology, Manufacturing, Clinical Operations, Regulatory and Legal teams.


text: We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments and penetration testing to inform our risk identification and assessment. Additionally, we engage external auditors and consultants to assess our internal cybersecurity program and our compliance with applicable practices and standards.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.


text: As part of the above processes, we engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs," which disclosures are incorporated by reference herein. We have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.


text: Cybersecurity is an important part of our overall risk management processes and an area of focus for our Board and management. Our Audit Committee of the Board oversees our cybersecurity risk and receives reports from our Chief Information Officer on a quarterly basis. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), status on key information security initiatives, industry trends, and other areas of importance.


text: We have also established an information technology management committee which is led by our Chief Information Officer, Chief Financial Officer, and Chief Legal Officer. The members of this committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: The Trust's cybersecurity risk management is established and governed by the Sponsor. The Sponsor determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Trust and the Trust relies on the Sponsor for assessing, identifying and managing material risks to the Trust's business from cybersecurity threats. The Sponsor's cybersecurity policies and practices are set out in the Sponsor's compliance manual and are reviewed on an annual basis. In addition, all officers of the Sponsor and all employees of Bitwise Asset Management, Inc. ("BAM"), the parent of the Sponsor, receive annual compliance training and annual cybersecurity training. Attendance at the annual cybersecurity training and the annual compliance training is tracked and recorded.

companyName: Bitwise Ethereum ETF

ticker: ETHW


text: The Sponsor engages a selection of third-party experts ("Experts") to assist its internal legal, compliance and engineering personnel in developing, implementing and testing its cybersecurity policies and procedures. The Experts assist in performing assessments, penetration tests and reviewed areas of potential vulnerability. In addition, the Experts work with the Sponsor to conduct cybersecurity training, exercises and quarterly internal phishing tests. The Sponsor uses the findings of such exercises and campaigns to improve its practices, procedures, and technologies. The Sponsor also engages the Experts to support its cybersecurity threat and incident response management and maintains information security risk insurance coverage.


text: The Sponsor conducts due diligence on the Experts and all third-party service providers both at the beginning of any contractual relationship and on an ongoing, periodic basis. The Sponsor reviews a selection of all of its service providers on an annual basis, with specific emphasis on any service providers deemed to be high risk and utilizes external compliance partners to assist with this review. As part of this review, the Sponsor tracks any identified deficiencies and requires that its third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards. The Sponsor also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements.


text: While neither the Sponsor nor the Trust has experienced a material cybersecurity incident during the year ended December 31, 2024, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition.


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. Hong Kim, the Chief Technology Officer of BAM is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action in conjunction with Katherine Dowling, the General Counsel and Vice President of the Sponsor. Mr. Kim graduated from the University of Pennsylvania with a Bachelor of Science in Computer Science, and, prior to BAM, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Mr. Kim and Ms. Dowling receive periodic reports from the Experts and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation, training and testing.


text: BAM, has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the BAM board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer and is on the Executive Management Team of BAM and therefore is able to report directly to BAM's board of directors regarding cybersecurity risks to the Trust and the Sponsor.


companyName: Bitwise Bitcoin ETF

ticker: BITB


text: BAM has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the BAM board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer and is on the Executive Management Team of BAM and therefore is able to report directly to BAM's board of directors regarding cybersecurity risks to the Trust and the Sponsor.


text: Assessment, Identification, and Management of Cybersecurity Risks The Company has processes in place to assess, identify and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy implemented by the Adviser and the Antares Parties, the providers of our technology services. The Adviser manages the Company's day-to-day operations and has implemented, together with the Antares Parties, a firm-wide cybersecurity program that applies to the Company and its operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by the Antares Parties, and (ii) any actions of the Adviser shall be deemed to refer to actions of the Antares Parties and/or the Adviser, as the context may require.

companyName: Antares Strategic Credit Fund


text: The Adviser employs a proactive and risk-based approach to assess, identify, and manage material cybersecurity risks. Under the leadership and direction of the Chief Information Security Officer ("CISO"), the cybersecurity program is structured around industry-leading frameworks, including the National Institute of Standards and Technology; MITRE Adversarial Tactics, Techniques, and Common Knowledge; and International Organization for Standardization 27001 (Information Security Management System standard) ensuring a comprehensive risk identification process.


text: The Adviser is fully committed to protecting the Company's systems and information as well as the information of the clients and professionals it serves.


text: Material Impact of Cybersecurity Risks The Adviser recognizes that cybersecurity risks have the potential to impact business operations, financial performance, regulatory compliance, and reputation. To mitigate these risks, the cybersecurity program is built on scalable, future-ready solutions designed to address current and evolving threats.


text: • Operational Impact: Cyber risks, such as ransomware, data breaches, and insider threats, are managed through a combination of robust Identity and Access Management (IAM), Privileged Access Management (PAM), and Application Security programs. These initiatives ensure secure access to critical systems and protect sensitive data from unauthorized exposure. • Reputational and Regulatory Considerations: With increasing regulatory oversight, the Adviser ensures compliance with industry standards and regulatory requirements, aligning cybersecurity measures with expectations from stakeholders and regulatory bodies. • Business Resilience: Through a well-defined Cyber Crisis Management Plan (CCMP) and Business Impact Analysis (BIA), the Adviser maintains a high level of preparedness, ensuring rapid response and recovery from cyber incidents.


text: During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: Oversight of Cybersecurity Risk Cybersecurity risk oversight at the Antares Parties is embedded within a governance structure that includes board-level engagement, cross-functional collaboration, and continuous monitoring of key cyber risk indicators.


text: The Company's Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the Board of Trustees about the Adviser's compliance with its responsibilities for the Adviser's and the Company's cybersecurity program. The Adviser's CISO works closely with Company management, including the CCO, to administer, assess, discuss, and prioritize the Company's cybersecurity efforts.


text: The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. The Company's CCO updates the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by the Company's CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to the Company, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on the Company's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management process in accordance with our risk profile and business that is informed by industry standards and is integrated into our enterprise risk management process.

companyName: Korro Bio, Inc.

ticker: KRRO


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and risk assessments, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We conduct employee cybersecurity training and maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents. Further, we intend to evaluate and update our existing cybersecurity policies and procedures as appropriate to continue to align them to our risk profile.


text: We have a process to assess the security practices of certain third-party vendors, including through the use of vendor security questionnaires, as appropriate.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third party vendors' data and systems. For more information about these risks, see Item 1A "Risk Factors—Risks Related to Our Business."


text: Related to Cybersecurity Risks Our Vice President, Information Technology, or Vice President, who reports to the Chief Operating Officer, is responsible for the strategic leadership and direction of our cybersecurity program. With over 20 years of experience in information technology, the Vice President works alongside individuals across other functions, such as legal and engineering, to establish and implement our cybersecurity strategy.


text: The Vice President and our Chief Operating Officer and General Counsel participate in periodic discussions with other members of our management, including executive leadership, regarding implementation of our cybersecurity program, program enhancements, and relevant cybersecurity risks or threats.


text: Our audit committee has oversight over cybersecurity risks. With the input of the executive team, the Vice President provides annual presentations to the audit committee on our cybersecurity program, including updates on cybersecurity testing and assessments, cybersecurity risks, and related cybersecurity strategy as applicable. The management team will also update the full board of directors on matters related to cybersecurity as needed.


text: Additionally, we have implemented an enterprise risk management process, which addresses cybersecurity risks. This process is led by our General Counsel and includes participation by the board of directors, as appropriate. Our General Counsel reports regularly on the enterprise risk management process to executive leadership and the audit committee.


text: We take a risk-based approach in implementing and maintaining various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials, products in development and proprietary technologies (IT Systems and Data).

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: Our information security function, supported by members of our IT department and our third party IT service providers, helps identify, assess and manage our cybersecurity threats and risks. This team helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: automated tools, subscribing to reports and services that identify cybersecurity threats and analyzing such reports of threats and actors, conducting scans of our threat environment, evaluating threats reported to us, conducting vulnerability assessments, and working with third parties to conduct certain tests of our environment.


text: Depending on the environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our IT Systems and Data, including, for example: incident detection and response procedures; an incident response policy; a disaster recovery plan; conducting risk assessments; maintaining network security controls; encrypting certain of our data; maintaining access and physical security controls; systems monitoring; assessing vendor risk; employee training; and maintaining cybersecurity insurance.


text: The cybersecurity risk management and mitigation measures we implement for certain of our IT Systems and Data including for example (1) cybersecurity risk is addressed as a component of our enterprise risk management assessment processes; (2) the information security function works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the Board, which evaluates our overall enterprise risk, (4) policies and procedures to manage how IT Systems and Data are collected, maintained and stored, (5) communicating with and training personnel on cybersecurity risks and trends.


text: We use third party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems, or those of any of our existing or future CROs, manufacturers, other contractors, consultants, or collaborators, may be compromised, which could result in additional costs, significant liabilities, harm to our reputation and material disruption of our operations."


text: Our Board of Directors, or Board, addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Audit Committee receive scheduled updates from senior management. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Chief Financial Officer (CFO) is primarily responsible for assessing and managing cybersecurity risks across the company based on the assessments by our Senior Director of IT and third party IT specialists. Additionally, our cybersecurity risk assessment and management processes are implemented and maintained by our Senior Director of IT with assistance from third party IT specialists. Our CFO has extensive experience managing risks at our company and at similar companies in the past, including risks arising from cybersecurity threats. Our Senior Director of IT has over 25 years of experience in IT security, and data analytics.


text: Our CFO is responsible for approving budgets and our Senior Director of IT is responsible for preparing for cybersecurity incidents, approving cybersecurity processes, and conducting regular reviews of security assessments and other security-related reports.


text: Our cybersecurity incident response is designed to escalate certain cybersecurity incidents to members of management. In addition, our cybersecurity incident response and vulnerability management policies and procedures include reporting to the Audit Committee of the Board for certain cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: In the ordinary course of our business, we may produce, store and process sensitive data. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program which is comprised of data segregation, physical, procedural, and technical safeguards along with policies and procedures. We have substantially outsourced our IT environment and utilize expert third party software-as-a-service providers for our financial accounting, human resource management, payroll and benefits functions. We also substantially outsource the conduct of our clinical programs and the associated IT infrastructure to expert third party CROs. As a result, the primary means by which we avoid cyber risk is minimizing the sensitive data within our own enterprise.


text: The cyber risk management program falls under the responsibility of our Chief Financial Officer ("CFO") and the Chief Operations Officer ("COO") who manages the overall security through routine communication and supervision of our third-party vendors. Under the guidance of our CFO, who reports to the Audit Committee, we try to minimize our data footprint to keep our cyber risk low.


text: We have implemented a cybersecurity risk management program that is designed to limit and mitigate risks from cybersecurity threats. Our cybersecurity risk management program incorporates several components, including employee training, SOC 2 Type 1 controls, multifactor authentication, endpoint monitoring, and we maintain Business Associate Agreements where required.


text: We do not believe that there are currently any known risks from cybersecurity threats that have affected, or are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition.


text: Governance; Board Oversight Under the ultimate direction of our CFO, with oversight from the Board, we maintain a security governance structure to evaluate and address cyber risk.


text: Our Board is responsible for the oversight of cybersecurity risk management. The Board delegates oversight function of the cybersecurity risk management program to the Audit Committee. Our CFO reports to the Audit Committee on the program. The Audit Committee provides updates to the Board on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on a regular and as-needed basis. The Audit Committee also notifies the Board of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.


text: QNB maintains comprehensive and continually evolving processes for assessing, identifying, and managing material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, QNB's information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing on such systems. The processes relating to cybersecurity threats are integrated into the QNB's overall risk management processes, which are overseen by the entire board of directors and not delegated to any committee or subcommittee of the board.

companyName: QNB CORP.

ticker: QNBC


text: As part of the QNB's overall risk management processes, it has established both the Information Technology Committee and the Information Security Committee. The Technology Committee comprises the executive management team, selected department heads, and the Information Security Officer ("ISO"). The Technology Committee reports to the Board of Directors. The second committee is the Information Security Committee, composed of QNB's Chief Operating Officer ("COO"), the Information Technology Director, and the ISO. The Information Security Committee reports to QNB's Audit Committee. QNB's COO presents a detailed report on information systems and cybersecurity matters to the Board of Directors at least once annually. The Board of Directors also receives and reviews copies of minutes of all meetings of the Audit Committee and the Information Technology Committee. The Audit Committee receives minutes from the Information Security Committee and audit reports related to Technology and Cyber control testing.


text: QNB Bank's information technology resources are managed by the Information Technology Department, which is responsible for identifying, assessing, and managing material risks from cybersecurity threats. The present COO, who reports directly to the current President and Chief Executive Officer ("CEO"), has been with QNB Bank for over eight years and has over twenty-five years of experience in banking technology and operations. He has an MBA in Management Information Systems and is a current Certified Information Systems Security Professional. QNB's IT Director and ISO report directly to the COO. Additionally, the ISO has a reporting line to the Audit Committee to ensure independence and transparency. The Information Technology Department is managed by the IT Director. The present IT Director has been employed by QNB Bank in the information technology area for ten years has been in the technology industry for over fifteen years and holds numerous technology certifications. QNB's ISO, whose responsibilities include security relating to QNB's information systems, is a Certified Information Systems Security Professional and a Certified Information Security Manager. The ISO, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to QNB's information systems, and monitors implemented checks and balances relating to access to information. Information relating to cybersecurity risks and cybersecurity incidents, if any, is reported by the COO and the ISO and to both the Information Technology Committee and the Information Security Committees. Additionally, cyber security incidents are reported to QNB's Board of Directors by the COO no less than quarterly.


text: QNB maintains an Incident Response Plan that provides documented guidelines for handling potential threats and taking appropriate measures, including timely notification of cybersecurity threats and incidents to senior management and the Board of Directors when appropriate. The Incident Response Plan is managed by the Information Security Committee and is reviewed and tested at least annually.


text: QNB uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing, and vulnerability assessment. The Information Security Committee has established risk management guidelines for third-party vendors. QNB conducts due diligence reviews of third-party vendors before contracts or agreements for the provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, QNB's agreements with service providers include cybersecurity and data privacy requirements.. All such agreements are reviewed at least annually. QNB cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, QNB may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that QNB shares with such providers.


text: To date, QNB has not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect QNB, including its business strategy, results of operations, or financial condition. As discussed under "Risk Factors" in Item 1A, however, the sophistication of cybersecurity threats continues to increase, and the preventative actions taken by QNB to reduce the risk of cybersecurity threats or incidents may not be sufficient in a particular circumstance. Accordingly, QNB may not be able to anticipate all cybersecurity breaches no matter how well designed or implemented QNB's cybersecurity controls and procedures are, and QNB may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: We operate in a highly regulated industry that requires the continued operation of advanced information technology systems and network infrastructure and we recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We manage these risks from cybersecurity threats through our enterprise risk management process which is overseen by our board of directors through an enterprise risk management policy. This policy requires a risk management committee, which is chaired by our President and CEO and also includes our other executive officers, and which is responsible for managing our risks including cybersecurity. The risk management committee meets on a monthly basis, and can be convened as needed to address any time-sensitive matters arising between scheduled meeting dates.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, investigate, resolve, remediate, and recover from identified vulnerabilities and security incidents in a timely manner. To address potential material cybersecurity risk in association with the use of third-party providers, we require they meet minimum security requirements. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities.


text: We identify and address cybersecurity threats through a multi-faceted approach including internal IT assessments and procedures, third-party assessments, internal audits, governance, and risk and compliance reviews. Identifying and assessing cybersecurity risk is integrated into our overall risk management processes.


text: We conduct proactive cybersecurity reviews of our systems and applications, audit applicable processes and applications, perform testing on our security controls, conduct exercises to simulate cybersecurity incidents, conduct employee training, and monitor emerging laws and regulations related to data protection and information security. We evaluate the results and responses to these efforts and implement appropriate changes to improve our security measures.


text: In accordance with our board policy for incident management and business continuity planning, we have implemented security incident response plans and security incident response teams. These teams include members from multiple functional areas of our organization that identify, investigate, respond, and resolve cybersecurity incidents. Cybersecurity incidents are evaluated and ranked by severity and prioritized for response. We also evaluate the need to include the use of third parties to assist us in the response to a cybersecurity incident. Our Senior Vice President of Power Supply leads the security response teams, and the activities of the security response teams are overseen by our senior management team. Based on the severity of incident, members of the senior management team determine whether the incident requires immediate escalation to our board of directors.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents have been immaterial. This includes penalties and settlements, of which there were none. For a description of whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business operations and financial condition, see "Risk Factors" in Item 1A.


text: Our board of directors oversees our biennial enterprise risk assessment process that we utilize to assess key risks within the company, including security and technology risks and cybersecurity threats. The audit committee of our board of directors oversees our internal control over financial reporting, including with respect to financial reporting-related information systems. The audit committee receives internal audit reports conducted by an independent audit firm on various cybersecurity matters. In addition, our risk management committee reviews and evaluates reports monthly, and as needed, related to cybersecurity activity and incidents.


text: Assessment, Identification, and Management of Cybersecurity Risks The Company has processes in place to assess, identify and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy implemented by the Adviser and the Antares Parties, the providers of our technology services. The Adviser manages the Company's day-to-day operations and has implemented, together with the Antares Parties, a firm-wide cybersecurity program that applies to the Company and its operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by the Antares Parties, and (ii) any actions of the Adviser shall be deemed to refer to actions of the Antares Parties and/or the Adviser, as the context may require.

companyName: Antares Private Credit Fund


text: The Adviser employs a proactive and risk-based approach to assess, identify, and manage material cybersecurity risks. Under the leadership and direction of the Chief Information Security Officer ("CISO"), the cybersecurity program is structured around industry-leading frameworks, including the National Institute of Standards and Technology; MITRE Adversarial Tactics, Techniques, and Common Knowledge; and International Organization for Standardization 27001 (Information Security Management System standard) ensuring a comprehensive risk identification process.


text: The Adviser is fully committed to protecting the Company's systems and information as well as the information of the clients and professionals it serves.


text: Material Impact of Cybersecurity Risks The Adviser recognizes that cybersecurity risks have the potential to impact business operations, financial performance, regulatory compliance, and reputation. To mitigate these risks, the cybersecurity program is built on scalable, future-ready solutions designed to address current and evolving threats.


text: • Operational Impact: Cyber risks, such as ransomware, data breaches, and insider threats, are managed through a combination of robust Identity and Access Management (IAM), Privileged Access Management (PAM), and Application Security programs. These initiatives ensure secure access to critical systems and protect sensitive data from unauthorized exposure. • Reputational and Regulatory Considerations: With increasing regulatory oversight, the Adviser ensures compliance with industry standards and regulatory requirements, aligning cybersecurity measures with expectations from stakeholders and regulatory bodies. • Business Resilience: Through a well-defined Cyber Crisis Management Plan (CCMP) and Business Impact Analysis (BIA), the Adviser maintains a high level of preparedness, ensuring rapid response and recovery from cyber incidents.


text: During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: Oversight of Cybersecurity Risk Cybersecurity risk oversight at the Antares Parties is embedded within a governance structure that includes board-level engagement, cross-functional collaboration, and continuous monitoring of key cyber risk indicators.


text: The Company's Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the Board of Trustees about the Adviser's compliance with its responsibilities for the Adviser's and the Company's cybersecurity program. The Adviser's CISO works closely with Company management, including the CCO, to administer, assess, discuss, and prioritize the Company's cybersecurity efforts.


text: The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. The Company's CCO updates the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by the Company's CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to the Company, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on the Company's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: We recognize the critical importance of maintaining the trust and confidence of our all of our stakeholders. Our business increasingly depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party contract research organizations, contract manufacturing organizations, or other vendors, contractors or consultants. Our board of directors and our management team are actively involved in the oversight of risk management, and cybersecurity represents an important component of our overall approach to compliance and risk management. Our cybersecurity policies, standards, processes and practices are integrated into our approach to compliance and risk management and follow recognized industry best practices. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect, process, and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Cybersecurity Risk Mitigation As one of the critical elements of our overall approach to compliance and risk management, our cybersecurity program is focused on the following key areas:


text: To ensure the confidentiality and integrity of data and systems, we leverage encryption of data during transfer and at rest whenever possible and as necessary, least privileged access when granting access, strong passwords and two-factor authentication, and version-controlled file systems.


text: To preserve the availability of data and systems, we perform daily backups with some occurring multiple times a day. Additionally, to mitigate ransomware, data is stored in version-controlled file systems. When implementing systems, architectural patterns for redundancy and failover are used.


text: Other Technical Safeguards: Additional technical safeguards that are designed to protect our information systems from cybersecurity threats include endpoint tools that detect and prevent threats on a computer and monitor for vulnerabilities, next generation firewalls, intrusion prevention and detection systems, and cybersecurity testing of our systems.


text: We maintain a security operations center that monitors our systems and networks for anomalous activity. Additionally, our information technology ("IT") team actively monitors different cybersecurity threat intelligence sources and responds accordingly based on risk.


text: We provide regular, mandatory security awareness training for personnel to educate our employees on cybersecurity threats and to communicate our evolving information security policies, standards, processes, and practices. In addition to the training, we periodically test employees with phishing emails.


text: Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: We have established and maintain comprehensive incident response and recovery plans to address our response to a cybersecurity incident.


text: We maintain a risk-based approach to identifying cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: We engage in the periodic assessment of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, penetration testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The results of such exercises, if material, are reported to the audit committee of our board and our board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our board of directors, in coordination with our audit committee, oversees our risk management process. Our audit committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our board of directors and audit committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, our board of directors and audit committee discuss our approach to cybersecurity risk management with our head of IT.


text: Our head of IT, in coordination and with support from our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee basis and appropriate third-party contractors, the head of IT and the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to our audit committee when appropriate.


text: Our head of IT has over 21 years of experience building and managing information systems with cybersecurity principles, such as least privileged access, patching and vulnerability management, encryption, etc., as part of a foundation to ensure confidentiality, integrity, and availability. Our head of IT has also served in consulting and architecture roles for cybersecurity and compliance projects ranging from design and auditing systems, red team testing, to compliance audits and remediation for the Sarbanes-Oxley Act of 2002, as amended, and the payment card industry data security standards.


text: No cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management Strategy The Company addresses cybersecurity risks through a comprehensive approach that is focused on preserving the security of its operations and information and ensuring the appropriate acquisition, access, use, or disclosure of PHI. Veradigm has implemented an enterprise-wide information security program ("IS Program") that is informed by core elements of the security standards encouraged by HHS, including relevant National Institute of Standards and Technology ("NIST") cybersecurity standards such as NIST SP 800-30, NIST SP 800-53, and NIST SP 800-63B, and ISO 27001and SOC2 suite of controls. Designed from a risk- and compliance-based approach, the IS Program is designed to protect Company information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction by identifying, preventing and mitigating cybersecurity threats, as well as effectively respond to cybersecurity incidents when they occur.

companyName: Veradigm Inc.


text: Veradigm's information security policies and procedures have been developed to align with recognized security practices and utilize multi-layered defenses. As part of the IS Program, the Company employs a range of tools and services to inform assessment, identification and management of material risks from cybersecurity threats, which include, from time to time, monitoring emerging data protection laws and implementing responsive changes to our processes; undertaking periodic reviews of our policies and statements related to cybersecurity; conducting annual privacy and security awareness training for all Veradigm workforce members, including contractors and subcontractors, and tracking compliance; and deploying phishing test campaigns. We have an incident response program, which is reviewed and updated annually, and our incident response team members participate in regularly scheduled management reviews and tabletop exercises to simulate responses to cybersecurity incidents.


text: Our IS Program includes the following elements: (i) internet and perimeter security; (ii) endpoint and email security; (iii) threat intelligence, monitoring and management; (iv) data security for PHI and Personally Identifiable Information ("PII"); (v) personal accountability, which includes comprehensive training for our employees and third party-contractors (including onboarding and annual training), exercises (including advanced phishing exercises) and awareness for our employees to promote vigilance of cybersecurity risks and opportunities; (vi) access management; (vii) application and cloud security; and (viii) compliance audits and assessments, which include routine technical and non-technical audits and assessments internally and in collaboration with independent third parties at least annually.


text: As a company managing the use and disclosure of PHI and PII, our Program incorporates annual independent Systems and Organization Control 2 (SOC 2) Type 2 audits that are conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants, which provide an independent third party evaluation of the design and operating effectiveness of our controls. We also annually perform HIPAA Security Rule risk assessments of our administrative, physical and technical safeguards for protecting the confidentiality, integrity and availability of data.


text: Our IS Program includes frequent reviews and development of our security policies and standards, monitoring to detect potential threats or disruptions, testing of protocols to verify the effectiveness of our defense systems, and training for our workforce. Our teams continuously and proactively monitor our information systems for potential risks, threats, and disruptions, including at our U.S.-based third-party data centers. Through the use of our rapid response and incident management processes, which include our IT incident management and IT disaster recovery processes, we assess potential incidents and determine a course of action. This may involve risk mitigation, resolution plan development and process improvements.


text: In parallel with our Code of Conduct, we have created and posted publicly, and incorporate into vendor contracting, our security standards for our contractors, subcontractors and other vendors and suppliers, which holds the third parties with which we do business to equivalent data and privacy standards as the Company, as applicable. We request Attestations of Compliance with such standards and execute HIPAA-compliant Business Associate Agreements in these contexts as appropriate.


text: Veradigm's Privacy & Security Executive Council ("PSEC") provides oversight of risks from cybersecurity threats. The Chief Security Officer ("CSO") provides oversight of Veradigm's IS Program and, along with the PSEC and other members of management, reviews material cybersecurity incidents, reviews key metrics on Veradigm's cybersecurity program and related risk management programs and manages cybersecurity program goals. The CSO updates the full Board on matters relating to cybersecurity.


text: The CSO is responsible for assessing and working with the business to manage the Company's material risks from cybersecurity threats. The CSO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy process described above, including the operation of Veradigm's incident response plan. Veradigm's CSO has served in this role for the past four years, and has more than 14 years of experience managing cybersecurity risk for HIPAA-regulated entities in various roles involving managing information security, developing cybersecurity strategy, application security, and developing healthcare cybersecurity at the Federal level, and has a Doctorate of Philosophy (Ph. D.) in privacy and security.


text: The Audit Committee is primarily responsible for overseeing and reviewing the Company's information security and technology risks, including cybersecurity. In this role, the Audit Committee monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the regular receipt of reports from management on the effectiveness of its cybersecurity programs. The Audit Committee reports to the full Board on a quarterly basis regarding its oversight activities and the risk management activities of the Company. In addition, the full Board receives periodic presentations from management on emerging information security and cybersecurity risks, as well as incident reports as significant matters may arise.


text: Our CSO conducts regular cross-functional management reviews of our programs, including with members of senior leadership. All employees and those contractors of the Company with access to our information systems receive annual cybersecurity awareness training, and we have integrated cybersecurity and data protection topics into our Code of Conduct. All critical information systems supporting our clients' clinical care have a written disaster recovery plan that is exercised at least annually. The entire program is audited annually by both internal and third-party auditors.


text: Cybersecurity is also included in our product development life cycle and part of our vendor and business partner evaluation process. Our product development approach considers cybersecurity best practices and builds security controls into our product design. Additionally, we conduct security risk assessments prior to engaging third-party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards and require they adhere to mutually agreed upon security requirements, controls and responsibilities.


text: On July 19, 2024, the Company experienced customer facing systems disruption resulting from the CrowdStrike-caused outage. Upon detecting the event, the Company took immediate steps designed to mitigate the impact of the incident and implement its business continuity plans to restore and support customer operations. The majority of client facing systems were restored within 24 hours and all affected systems were fully restored in fewer than three calendar days.


text: As previously disclosed, the Change Healthcare cybersecurity incident in the first quarter of 2024 disrupted our Company's customers' ability to use Change Healthcare's network connections, thus affecting their insurance claims submissions and billing activities through our systems. Although the Company's information systems were not affected, the cybersecurity incident experienced by Change Healthcare resulted in delay and downtime for our customers. The Company took immediate steps designed to mitigate the impact of the incident for our customers with respect to our solutions.


text: The Company did not experience a material cybersecurity incident in 2024. It did, however, experience the previously-disclosed impacts from the Change Healthcare cybersecurity incident in the first and second quarters of 2024. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see "Risk Factors – "Significant disruptions of information technology systems or breaches of information security could materially and adversely affect our business, financial condition and operating results." which is incorporated by reference into this Item 1C.


text: As an externally managed company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior professionals of our Adviser and our Adviser is a subsidiary of J.P. Morgan. As such, we are reliant on J.P. Morgan for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Cybersecurity risk is an important and continuously evolving focus for us, the Adviser, J.P. Morgan, and its affiliates. Significant resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology. The Adviser's security efforts are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access to confidential information, the destruction of data, disruptions to or degradation of service, sabotaging systems or other damage.


text: The Adviser, J.P. Morgan, and its affiliates have experienced, and expect to continue to experience, a higher volume and complexity of cyber attacks against the backdrop of heightened geopolitical tensions. J.P. Morgan has implemented measures and controls reasonably designed to address this evolving environment, including enhanced threat monitoring. In addition, J.P. Morgan continues to review and enhance its capabilities to address associated risks, such as those relating to the management of administrative access to systems.


text: Third parties with which we, the Adviser, J.P. Morgan and its affiliates do business, that facilitate our, the Adviser's, J.P. Morgan's, and its affiliates' business activities (e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries) or that J.P. Morgan has acquired are also sources of cybersecurity risk to us. Third party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber attacks, including ransomware and supply-chain compromises, could have a material adverse effect on J.P. Morgan, including in circumstances in which an affected third party is unable to deliver a product or service to us or the Adviser, where the incident delivers compromised software to J.P. Morgan or results in lost or compromised information of J.P. Morgan or its clients or customers.


text: Clients and customers are also sources of cybersecurity risk to us, the Adviser, J.P. Morgan and its affiliates and its information assets, particularly when their activities and systems are outside of J.P. Morgan's own security and control systems. J.P. Morgan engages in periodic discussions with its clients, customers and other external parties concerning cybersecurity risks including opportunities to improve cybersecurity.


text: Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected us or our business strategy, results of operations or financial condition. Notwithstanding the comprehensive approach that J.P. Morgan takes to address cybersecurity risk, J.P. Morgan may not be successful in preventing or mitigating a future cybersecurity incident that could have a material adverse effect on us, the Adviser, J.P. Morgan or its affiliates or its business strategy, results of operations or financial condition.


text: Organization and Management The Global Chief Information Security Officer ("CISO") reports to the Global Chief Information Officer, and is a member of key cybersecurity governance forums. The CISO leads the Global Cybersecurity and Technology Controls organization, which is responsible for identifying technology and cybersecurity risks and for implementing and maintaining controls to manage cybersecurity threats. The CISO and the members of senior management within Global Technology and the Cybersecurity and Technology Controls organizations all have relevant expertise and experience in cybersecurity and information technology risk management, including relevant experience at J.P. Morgan, at other financial services companies or in other highly-regulated industries.


text: The CISO is responsible for J.P. Morgan's Information Security Program, which is designed to prevent, detect and respond to cyber attacks in order to help safeguard the confidentiality, integrity and availability of J.P. Morgan's infrastructure, resources and information. The program includes managing J.P. Morgan's global cybersecurity operations centers, providing training, conducting cybersecurity event simulation exercises, implementing J.P. Morgan's policies and standards relating to technology risk and cybersecurity management, and enhancing, as needed, J.P. Morgan's cybersecurity capabilities.