text: In addition, our management team has established an internal Cyber Steering Committee (the "Cyber SteerCo"), which includes processes designed to identify, assess, categorize, and monitor key current and evolving risks facing us, including cybersecurity risks. Each of the CDIO/CISO and CTO/CISO sit on the Cyber SteerCo along with our General Counsel and former CISO.


text: Management is made aware of current and evolving cybersecurity risks through the Cyber SteerCo reporting. Furthermore, in the event of a material or potentially material cybersecurity event, our process as designed is intended to result in senior members of management being promptly informed of such event and oversee triage, response, and disclosure efforts pursuant to the terms of a documented incident response plan.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN

secItem: Item 1C


text: We rely on the cybersecurity policies and procedures implemented by New Mountain Capital. New Mountain Capital has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to New Mountain Capital's Information Security Program, the New Mountain Capital Information Technology Steering Committee ("ITSC") is responsible for the development, evolution, and implementation of policies and technical measures to reasonably prevent security incidents. At times New Mountain Capital may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: New Mountain Guardian III BDC, L.L.C.


text: New Mountain Capital uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, New Mountain Capital uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, New Mountain Capital also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected. New Mountain Capital also requires that all employees, including employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "The failure of cybersecurity protection systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively," which should be read in conjunction with the information above.


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of directors on developments to the information security and cybersecurity risks facing us. Reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us. Additional information about cybersecurity risks we face is discussed in Item 1A..—Risk Factors.—Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to follow our industry's best practices and provides a framework for identifying, monitoring, assessing, and responding to cybersecurity threats and incidents, including threats and incidents associated with the use of third-party vendors and service providers, and facilitating coordination across different departments of the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider; assessing the severity and risk of a cybersecurity threat or incident; implementing cybersecurity countermeasures and mitigation strategies and informing management, our audit and risk committee, and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.

companyName: Remitly Global, Inc.

ticker: RELY


text: Our information security team is responsible for assessing and maintaining our cybersecurity risk management program. In addition, our information security team engages third-party security experts on an as-needed basis for risk assessment and system enhancements. Our information security team also facilitates training to all employees during the onboarding process and annually, with additional training as we deem appropriate. We review or update our cybersecurity policies annually, or more frequently on an as-needed basis, to account for changes in the evolving cybersecurity threat landscape as well as legal and regulatory developments. Although we have continued to invest in our due diligence, onboarding, and monitoring capabilities over critical third parties with whom we do business, including our third-party vendors and service providers, our control over the security posture of, and ability to monitor the cybersecurity practices of, such third parties remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such third parties. When we do become aware that a third-party vendor or service provider has experienced such compromise or failure, we attempt to mitigate our risk, including by terminating such third party's connection to our information systems and networks where appropriate.


text: In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors–Cybersecurity, Privacy, Intellectual Property, and Technology Risks" in this Annual Report on Form 10-K.


text: Our management, Chief Information Security Officer ("CISO"), information security team, and legal team are responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our CISO, who receives reports from our information security team and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. Our CISO and dedicated information security personnel maintain certain cybersecurity-related certifications and are experienced information systems security professionals and information security managers with many years of experience. In particular, our CISO maintains the following certifications: Certified Information Systems Auditor from the Information System Audit and Control Association and Certified Information Systems Security Professional from ISC2. Our management, CISO, and information security team provide updates on at least a quarterly basis to our audit and risk committee on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies, and provide cybersecurity reports on at least a quarterly basis that cover, among other topics, third-party assessments of the Company's cybersecurity programs, updates to the Company's cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to such regular updates, and as part of our incident response processes, our CISO also provides updates on certain cybersecurity threats and incidents to the audit and risk committee and, as necessary, to the full board of directors, based on the assessment of risk by our management, CISO, information security team, and legal team.


text: Our board of directors has oversight responsibility for our overall enterprise risk management, and delegates cybersecurity risk management oversight to our audit and risk committee. As part of its enterprise risk management efforts, our board of directors also meets with management, including our CISO, to assess and respond to critical business risks, including those that may arise from cybersecurity threats and incidents. Our audit and risk committee is responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess, and respond to cybersecurity, data privacy, and other information technology risks to which the Company is exposed. Further, our audit and risk committee reports material cybersecurity risks to our full board of directors, based on the assessment of risk by our management, CISO, information security team, and legal team.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to follow our industry's best practices and provides a framework for identifying, monitoring, assessing, and responding to cybersecurity threats and incidents, including threats and incidents associated with the use of third-party vendors and service providers, and facilitating coordination across the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation strategies, evaluating any related disclosure obligations, and informing management, our audit and risk committee, and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.


text: In 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors–Cybersecurity, Privacy, Intellectual Property, and Technology Risks" in this Annual Report on Form 10-K.


text: Our management, Chief Information Security Officer ("CISO"), information security team, and legal team are responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our CISO, who receives reports from our information security team and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. Our CISO and dedicated information security personnel maintain certain cybersecurity-related certifications and are experienced information systems security professionals and information security managers with many years of experience. In particular, our CISO maintains the following certifications: Certified Information Systems Auditor from the Information System Audit and Control Association and Certified Information Systems Security Professional from ISC2. Our management, CISO, and information security team provide updates on at least a quarterly basis to our audit and risk committee on the Company's cybersecurity programs and material cybersecurity risks and mitigation strategies, and provide cybersecurity reports on at least a quarterly basis that cover, among other topics, third-party assessments of the Company's cybersecurity programs, updates to the Company's cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to such regular updates, and as part of our incident response processes, our CISO also provides updates on certain cybersecurity threats and incidents to the audit and risk committee and, as necessary, to the full board of directors, based on the assessment of risk by our management, CISO, information security team, and legal team.


text: Our board of directors has oversight responsibility for our overall enterprise risk management, and delegates cybersecurity risk management oversight to our audit and risk committee. As part of its enterprise risk management efforts, our board of directors also meets with management to assess and respond to critical business risks, including those that may arise from cybersecurity threats and incidents. Our audit and risk committee is responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess, and respond to cybersecurity, data privacy, and other information technology risks to which the Company is exposed. Further, our audit and risk committee reports material cybersecurity risks to our full board of directors, based on the assessment of risk by our management, CISO, information security team, internal audit team, and legal team.


text: The Company and the broader financial services industry face an increasingly complex and evolving threat environment.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Adviser and the Administrator manage the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and stockholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley forensics team, which develops and implements technologies designed to help detect these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Where a potential threat is identified in Morgan Stanley's environment or which impacts the Company, Morgan Stanley's incident response team evaluates the potential impact to the Firm and, as relevant, the Company, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department, review external cybersecurity incidents that may be relevant to the Firm and the Company, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular training exercises for its employees and consultants, including those personnel relied upon by the Company.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Risk, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company. Those processes are periodically tested through tabletop exercises.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally and relies on the CIO, CISO, and Head of Operational Risk to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of Operational Risk has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of Operational Risk report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, the CISO, and the Head of Operational Risk, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2023, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to the Firm and the Company, to further inform the design of the Cybersecurity Program. To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to the Firm and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk, ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, CISO, and Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and Board, as appropriate. The BOTC has primary responsibility for assisting the Morgan Stanley board in its oversight of significant operational risk exposures of the Firm and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.


text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the Gramm-Leach-Bliley Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the Morgan Stanley board and, in accordance with such board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the Morgan Stanley board on cybersecurity risks and threats and other related matters.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2024, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: As discussed under the "Risk Factors" heading in this Annual Report, our business has been and may again in the future be impacted by disruptions to our IT infrastructure or our third-party providers' IT infrastructures from (among other causes) cybersecurity-based risks, including attacks (i) on our IT infrastructure (ii) targeting the security, integrity and/or availability of hardware and software; (iii) exploiting weaknesses or vulnerabilities in products, or capturing information installed, stored or transmitted in our products (including after the purchase of those products and when they are installed into third-party products); and (iv) on facilities or similar infrastructure. Risk Management and strategy.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: We mitigate cybersecurity risks (and other material risks) through our enterprise risk management ("ERM") program, which is a company-wide effort, managed by senior executives and overseen by our Audit Committee and Board of Directors to identify, assess, manage, report and monitor material risks that may affect our ability to achieve our business objectives.


text: In connection with the ERM process, cybersecurity risks, including those relating to risks posed by our use of third-party service providers, are assigned to cross-functional management committees responsible for identifying and classifying the cybersecurity risks in accordance with our ERM risk rating methodology, and developing and administering risk mitigation and incident response plans. These cross-functional management committees regularly meet to review current and emerging cybersecurity risks and maintain policies and procedures governing the evaluation and classification of such risks.


text: Cybersecurity risks deemed to be critical are reviewed by a Critical Threat Committee, which is comprised of members of our senior leadership team including our Chief Financial Officer, Chief Legal Officer, Chief Digital Officer, Chief Operating Officer, Chief Technology Officer, and Controller. The Critical Threat Committee reviews the risk and mitigation plan with the applicable cross-functional management team and facilitates notification to the Audit Committee of emerging critical cybersecurity risks. The Audit Committee and the Board of Directors receive regular briefings on cybersecurity risks. See "—Governance" below for further discussion of governance of our cybersecurity program.


text: In the event of a cybersecurity incident, we maintain incident response plans to investigate, classify, respond to, and manage cybersecurity incidents that may compromise the availability or integrity of our information systems, network resources, or data. In accordance with the incident response plans, cross-functional management teams assess and assign a threat level to each cybersecurity incident. A cybersecurity incident (or incidents, if aggregated together) assigned a critical threat level is escalated to the Critical Threat Committee for review.


text: To ensure that our employees are equipped to identify and mitigate material cybersecurity incidents and to empower them to help us maintain a secure environment for our operations and data assets, we utilize a multifaceted training approach aimed at fostering a culture of security awareness and responsibility among all employees. These tailored programs are designed and updated to address evolving threats and industry best practices. In addition to annual cybersecurity training for employees and contractors and simulated phishing email campaigns, our cybersecurity teams conduct tabletop exercises with our senior management team. Our cybersecurity teams also oversee a security assessment process that is used to screen our third-party service providers for cybersecurity vulnerabilities based on the level of inherent risk they pose to the company or our customers, based on factors including but not limited to the products or services they provide and their ability to access our information systems, network resources, or data.


text: We engage and retain outside consultants and legal advisors and we are members of several cybersecurity industry groups to keep us apprised of emerging cybersecurity risks, defense and mitigation strategies and governance best practices. Many of our processes and procedures have been independently audited and assessed against some of the leading international cybersecurity standards and programs.


text: Cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are made by groups of individuals with a wide range of expertise and motives which increases the difficulty of detecting and successfully defending against them. However, to date, cybersecurity threats have not materially affected us, including our business, strategy, results of operations or financial condition.


text: Our cybersecurity programs, including the cross-functional management committees responsible for identifying, assessing, and mitigating cybersecurity risks and incidents, are owned by our Chief Information Officer. Day-to-day administration of the cybersecurity programs are led by our Chief Information Security Officer and Chief Product Security Officer who collectively possess over 30 years of experience related to cybersecurity issues in both the private and government sectors, and possess certifications including but not limited to Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM").


text: Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. Although the Audit Committee maintains primary responsibility for oversight of cybersecurity risks through the ERM program, responsibility related to oversight of cybersecurity risks is also delegated to other committees in alignment with their focus charter responsibilities. For example, the Technology and Innovation and Governance Committees assist with the cybersecurity programs through their oversight of our technology, digital, and innovation strategies and product integrity program, respectively.


text: The Critical Threat Committee is also responsible for evaluating the materiality of a cybersecurity incident based on criteria that has been reviewed with the Board of Directors, and for determining whether there are disclosure obligations under applicable securities laws. In the event that the Critical Threat Committee determines that a critical cybersecurity incident (or incidents, if aggregated together) is deemed to be material, the Critical Threat Committee will brief the Board of Directors and oversee the disclosure process. For all critical cybersecurity incidents that are not deemed to be material, the Critical Threat Committee will notify the Chairman of the Board to determine whether the Board of Directors will be notified of the critical incident during the next regularly-scheduled cybersecurity update to the Audit Committee, or sooner as circumstances warrant.


text: As discussed under the "Risk Factors" heading in this Annual Report, our business has been and may again in the future be impacted by disruptions to our Technology infrastructure or our third-party providers' Technology infrastructures from (among other causes) cybersecurity-based risks, including attacks (i) on our Technology infrastructure (ii) targeting the security, integrity and/or availability of hardware and software; (iii) exploiting weaknesses or vulnerabilities in products, or capturing information installed, stored or transmitted in our products (including after the purchase of those products and when they are installed into third-party products); and (iv) on facilities or similar infrastructure.


text: Cybersecurity risks deemed to be critical are reviewed by a Critical Threat Committee, which is comprised of members of our senior leadership team including our Chief Financial Officer, Chief Legal Officer, Chief Digital Officer, Senior Vice President of Operations, Chief Technology Officer, Chief Product Officer and Controller/Chief Accounting Officer. The Critical Threat Committee reviews the risk and mitigation plan with the applicable cross-functional management team and facilitates notification to the Audit Committee of emerging critical cybersecurity risks. The Audit Committee and the Board of Directors receive regular briefings on cybersecurity risks. See "Governance" below for further discussion of governance of our cybersecurity program.


text: We engage and retain outside consultants and legal advisors and we are members of several cybersecurity industry groups to keep us apprised of emerging cybersecurity risks, defense and mitigation strategies and governance best practices. Many of our processes and procedures are independently audited and assessed on a periodic basis against leading international cybersecurity standards and programs.


text: Our cybersecurity programs, including the cross-functional management committees described above are the responsibility of our Chief Information Security Officer. Day-to-day administration of the cybersecurity programs are led by our Chief Information Security Officer and Chief Product Security Officer who collectively possess significant experience related to cybersecurity issues in both the private and government sectors, and possess certifications including but not limited to Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM").


text: We rely on technology, including the internet and mobile services, to conduct much of our business activity and allow our customers to conduct financial transactions on our platform. As a result, our systems and operations as well as those of the third parties on which we rely to conduct certain key functions are vulnerable to cybersecurity incidents, which we have experienced in the past. We have a cybersecurity program that includes physical, technological, and administrative controls to detect, contain, respond to and remediate cybersecurity threats and incidents and defined processes to assess, identify and manage material risks from cybersecurity threats. These controls and processes include, among others: • maintaining a vulnerability management program that performs regular vulnerability scans and relies on our risk-based information security program to promote coverage of critical areas; • establishing an offensive security team that actively tests our security controls, imitating methods persons trying to achieve unauthorized access might use to identify any weaknesses; • our global privacy program supported by our privacy engineering and privacy legal teams and the Privacy Advisory Council, a cross functional team of senior leaders from legal, engineering, product, and compliance; • maintaining an incident response plan which includes required responses in the event of a cybersecurity incident; • conducting mandatory annual security and privacy training for all employees and contractors and, where appropriate, giving employees and contractors role-based training focused on content specific to their role at the Company; • undertaking an annual review of our consumer facing policies and statements related to cybersecurity; • requiring employees to treat customer information and data with care through policy, practice and contract (as applicable); • leveraging the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Our cybersecurity program is managed by the Company's Security and Corporate Engineering organization, which is led by our CSO, who reports directly to the CEO. Currently, our CSO is Erika Dean. Ms. Dean, who joined the Company in 2021, has over twenty years of experience in the security industry. Prior to joining our Company, she held a variety of leadership positions in cybersecurity at Capital One, including as Vice President, Divisional Chief Information Security Officer. Additionally, several of Robinhood's subsidiaries, including RHC, RHF, and RHS, have a Chief Information Security Officer, who reports to the CSO, and a Risk Operating Committee ("ROC") that manages risks, including cybersecurity risks, specific to each entity. The Chief Information Security Officers have expertise in cybersecurity, industry and regulatory standards, risk management, and security operations. The Security organization elevates risks to the ROCs where applicable. Our cybersecurity program is aligned with industry standards and best practices, such as the NIST CSF, and we engage third-party consultants annually to conduct a NIST CSF maturity assessment of our cybersecurity program.


text: We maintain a Third Party Security and Privacy Policy and conduct security reviews of vendors, including for potential fourth-party risks, prior to and during their contracts with Robinhood and require all third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Any identified security or privacy risks of doing business with a vendor, including potential fourth-party risks, are highlighted to business owners to help make informed risk-based decisions.


text: We also engage the assistance of third-party consultants to increase protection of our information and IT systems and network to help secure long-term value for our stakeholders. Services provided by third-party consultants include, but are not limited to: regular assessments to our cybersecurity program including cyber maturity assessments and penetration tests; risk scoring of our critical business partners and vendors; and participating in incident response processes.


text: Management is responsible for day-to-day risk operations and management processes. Management has established cybersecurity standards to improve the Company's cybersecurity risk posture and to help define and implement appropriate measures to protect the Company's systems and data from cyber threats. In addition to our Internal Audit and Compliance functions, the Company has a management ERC, which comprises senior leaders of the Company, including the CEO, CFO, CLO, CSO, Vice President of Risk and Audit, and CBO, among others, and reviews on at least a quarterly basis risks that are escalated by the Company's ERM function, including cybersecurity risks. ERM maintains a risk taxonomy and a scoring methodology design to ensure risks are elevated in a clear and transparent manner, and further escalates top risks to the Safety Committee, along with planned mitigants and monitoring procedures.


text: If a cybersecurity incident occurs, incident response procedures are in place to ensure that the occurrence is appropriately reported to the CSO, and business continuity plans are mobilized to minimize disruption to business operations. We have also implemented guidelines to outline communications responsibilities during incidents of all severity levels, including the escalation process for alerting senior management of high severity incidents.


text: If a significant cybersecurity incident occurs, we will conduct an assessment to determine if it is material to us. If a materiality assessment is required, the CSO will report such an incident to our Materiality Assessment Committee ("MAC"), which consists of the CFO, CLO, and CBO (in addition to the CSO). The MAC will then determine, without unreasonable delay, whether the incident is material to the Company. In making such determination, the MAC may consult with the CEO, other members of the Company's management, and the Company's outside professional advisors, in each case, as appropriate. The incident materiality determination will be made by considering all relevant quantitative and qualitative factors, including without limitation: the nature, size and scope of the incident; financial condition; results of operations; litigation or regulatory investigations/actions; the Company's reputation, and customer and vendor relationships; and competitiveness.


text: The principal role of our board of directors and the Safety Committee is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The Safety Committee reviews management's exercise of its responsibility to identify, assess, manage, monitor and mitigate material risks not specifically allocated to the board of directors or another of its committees. The Safety Committee has been explicitly assigned the responsibility to oversee risks from cybersecurity threats, among others, and the full board of directors will be notified when the MAC is assessing a cybersecurity incident and informed of any required disclosures. Our board of directors and Safety Committee receive updates on relevant industry developments, threats, and material risks identified as needed each quarter. The board of directors and the Safety Committee also receive updates, including material legal and legislative developments, concerning data privacy and security, the rapidly evolving cybersecurity risk landscape, and the Safety Committee facilitates the board of directors' oversight responsibilities.


text: Our systems and those of our customers and third-party service providers have been and might in the future be vulnerable to cybersecurity threats. For more information about risks related to cybersecurity threats, including previous cybersecurity incidents (including the November 2021 Data Security Incident (defined below)), that have materially affected or are reasonably likely to materially affect our business, financial condition, and results of operations, see "Risk Factors–Our business could be materially and adversely affected by a cybersecurity breach or other cybersecurity incident involving our information systems or data or those of our customers or third-party or fourth-party service providers."


text: We rely on technology, including the internet and mobile services, to conduct much of our business activity and allow our customers to conduct financial transactions on our platform. As a result, our systems and operations as well as those of the third parties on which we rely to conduct certain key functions are vulnerable to cybersecurity incidents, which we have experienced in the past. Although no organization can eliminate cybersecurity and information technology risk completely, w e have a cybersecurity program that includes physical, technological, and administrative controls designed to detect, contain, respond to and remediate cybersecurity threats and incidents and defined processes to assess, identify and manage material risks from cybersecurity threats. These controls and processes include, among others: • maintaining a vulnerability management program that performs regular vulnerability scans and relies on our risk-based information security program to promote coverage of critical areas; • establishing an offensive security team that actively tests our security controls, imitating methods persons trying to achieve unauthorized access might use to identify any weaknesses; • our global privacy program supported by our privacy engineering and privacy legal teams; • maintaining an incident response plan which outlines the roles and responsibilities of key personnel in the event of a cybersecurity incident; • conducting mandatory annual security and privacy training for employees and contractors and, where appropriate, giving employees and contractors role-based training focused on content specific to their role at the Company; • undertaking an annual review of our consumer facing policies and statements related to cybersecurity; • requiring our employees to treat customer information and data with care through policy, practice and contract (as applicable); and • carrying cybersecurity insurance that provides some protection against potential losses arising from a cybersecurity incident.


text: Our cybersecurity program is managed by the Company's Security and Corporate Engineering organization, which is led by our CSO, who reports directly to the CEO. Our CSO has over twenty years of experience in the security industry and has held a variety of leadership positions in cybersecurity at Capital One, including as Vice President, Divisional Chief Information Security Officer. Additionally, several of Robinhood's subsidiaries, including RHC, RHF, and RHS, have a Chief Information Security Officer, who reports to the CSO, and a Risk Operating Committee ("ROC") that manages risks, including cybersecurity risks, specific to each entity's business. Each of our Chief Information Security Officers has expertise in cybersecurity, industry and regulatory standards, risk management, and security operations. The Security organization elevates risks to the relevant ROCs where applicable. Our cybersecurity program is aligned with industry standards and best practices, such as the NIST CSF, and we engage third-party consultants annually to conduct a NIST CSF maturity assessment of our cybersecurity program.


text: We maintain a Third Party Security and Privacy Standard and conduct security reviews of vendors, including for potential fourth-party risks, prior to and during their contracts with Robinhood and require all third-party service providers with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal standards and industry standards. Any identified security or privacy risks of doing business with a vendor, including potential fourth-party risks, are highlighted to business owners to help make informed risk-based decisions.


text: We also engage the assistance of third-party consultants to increase protection of our information and IT systems and network to help secure long-term value for our stakeholders. Services provided by third-party consultants include, but are not limited to: regular assessments of our cybersecurity program including cyber maturity assessments and penetration tests; risk scoring of our critical business partners and vendors; and participating in incident response processes.


text: Our management is responsible for the Company's day-to-day risk operations and management processes. Management has established cybersecurity standards to improve the Company's cybersecurity risk posture and to help define and implement appropriate measures to protect the Company's systems and data from cyber threats. In addition to our Internal Audit and Compliance functions, the ERM team partners with various front-line risk teams and risk owners across Robinhood, to foster consistent risk management practices across Robinhood. In particular, the ERM team provides governance over risk management practices and reports on a quarterly basis on top risks to the Safety Committee, along with planned mitigants and monitoring procedures.


text: If a cybersecurity incident occurs, incident response procedures are in place to facilitate the appropriate reporting to the CSO, and business continuity plans are mobilized to minimize disruption to business operations. We have also implemented guidelines to outline communications responsibilities during incidents of all severity levels, including an escalation process for alerting senior management of high severity and material incidents.


text: If a significant cybersecurity incident occurs, we will conduct an assessment to determine if it is material to us. If a materiality assessment is required, the CSO will report such an incident to our Materiality Assessment Committee ("MAC"), which consists of the CFO, CLO, and CBO (in addition to the CSO) and notify the CEO. The MAC will then determine, without unreasonable delay, whether the incident is material to the Company. In making such determination, the MAC may consult with the CEO, other members of the Company's management, and the Company's outside professional advisors, in each case, as appropriate. The incident materiality determination will be made by considering all relevant quantitative and qualitative factors, including without limitation: the nature, size and scope of the incident; financial condition; results of operations; litigation or regulatory investigations/actions; the Company's reputation, and customer and vendor relationships; and competitiveness.


text: The principal role of our board of directors and the Safety Committee, a board-level committee composed solely of independent directors, is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The Safety Committee reviews management's exercise of its responsibility to identify, assess, manage, monitor and mitigate material risks not specifically allocated to the board of directors or another of its committees. The Safety Committee has been explicitly assigned the responsibility to oversee risks from cybersecurity threats, among others, and the full board of directors will be notified when the MAC is assessing a cybersecurity incident and informed of any required disclosures. Our board of directors and Safety Committee receive updates on relevant industry developments, threats, and material risks identified as needed each quarter, including material legal and legislative developments, concerning data privacy and security, the rapidly evolving cybersecurity risk landscape, and the Safety Committee facilitates the board of directors' oversight responsibilities.


text: The Company maintains a cybersecurity program that establishes safeguards for protecting the confidentiality, integrity, and availability of the Company's data, technology, and information systems, and the material risks associated with the threats identified from time to time under the cybersecurity program are incorporated into the Company's corporate risk register. The program includes general controls for managing changes in and access to the Company's information technology environment, cybersecurity awareness and training programs to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite the Company's response in the event of a cybersecurity incident, and guidelines regarding system vulnerability management, third-party threat intelligence, endpoint detection and response solutions, and network security measures.

companyName: APA Corp

ticker: APA


text: The program also establishes protocols for identifying and managing material risks related to cybersecurity threats associated with the Company's use of third-party service providers. The Company monitors and oversees the material risks related to vulnerabilities, threats, and incidents impacting its third-party service providers via onboarding reviews, threat intelligence reports, and annual assessments. As an example of the Company's efforts to manage third-party cybersecurity risks, when third parties are engaged to provide software-as-a-service offerings, the Company's standard licensing terms require such third parties to utilize safeguards to protect the Company's data, in compliance with applicable standards from the International Organization for Standardization (ISO) regarding security techniques, and to notify the Company within 24 hours of becoming aware of a cybersecurity incident impacting the Company's data.


text: As of December 31, 2023, no risks from cybersecurity threats or incidents have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: In 2023, the Company's Board of Directors established a standing Cybersecurity Committee to assist with oversight of the Company's cybersecurity program and the material risks associated with the threats identified under the program. Given the Cybersecurity Committee's chair's previous military experience in positions relevant to information security and his NACD-sponsored CERT Certificate in Cybersecurity Oversight from Carnegie Mellon University's Software Engineering Institute, the committee benefits from his perspectives, skills, and training when reviewing and managing the Company's exposure to cybersecurity risks.


text: As stated in its charter, the Cybersecurity Committee's responsibilities include: • providing oversight of the Company's cybersecurity policies, procedures, and plans, including the quality and effectiveness of the cybersecurity program; • reviewing the Company's policies and procedures related to its preparation for, defense against, response to, and recovery from material cybersecurity incidents; • reviewing with management the plans and methodology for periodic assessments of the Company's cybersecurity program by outside professionals, including the findings of such assessments and plans to remediate any material deficiencies identified by such assessments; • overseeing the Company's management of risks related to its cybersecurity systems and processes; • reviewing with management any cybersecurity insurance program the Company may procure, including with respect to coverage and limits; and • overseeing the preparation of the Company's disclosures in its reports filed with the Securities and Exchange Commission relating to the Company's cybersecurity systems.


text: The Cybersecurity Committee also has authority to retain cybersecurity and other consultants and advisors to assist and advise the committee in its evaluation of the Company's cybersecurity program.


text: The Cybersecurity Committee receives regular reports from Company management regarding the Company's cybersecurity systems and programs, and the committee from time to time also receives updates from external cybersecurity specialists on cybersecurity trends and incidents, including those that may be particularly relevant to the Company's industry or operations. In addition, in exercising its oversight responsibilities, the Cybersecurity Committee has full access to Company management and may inquire into any matter that it considers to be of material concern to the committee or the full Board of Directors.


text: The Cybersecurity Committee reports regularly to the full Board of Directors, with respect to such matters as are relevant to the committee's discharge of its responsibilities and with respect to such recommendations as the committee deems appropriate for consideration by the Board of Directors. The Cybersecurity Committee also refers to the Audit Committee any matters that come to the attention of the Cybersecurity Committee that fall within the purview of the Audit Committee, including any matters related to the Company's internal control over financial reporting.


text: APA's Chief Information Officer (the CIO) is primarily responsible for the day-to-day operation of the Company's cybersecurity program and for identifying, assessing, and managing the material risks associated with the cybersecurity threats and incidents identified from time to time thereunder. The CIO manages the Company's Information Security Team, which is comprised of cybersecurity professionals responsible for managing the Company's threat intelligence, vulnerability management, forensics, and security architecture systems and processes. The CIO has a Bachelor of Science in Computer Science and over 25 years of experience managing data and technology in the energy industry. He also receives regular updates from external cybersecurity specialists on emerging trends, threats, and technologies in the cybersecurity industry. The CIO reports directly to APA's Executive Vice President, Administration, who, along with the CIO, presents all relevant information to the Cybersecurity Committee.


text: Additionally, in 2023, the Company established its CyberSmart Defender Network, which is a multi-disciplinary team that includes representatives from across the Company's various departments, responsible for raising awareness of cybersecurity issues, sharing learnings, and gaining access to advanced cybersecurity information and training.


text: Under the direction of the CIO, management's responsibilities with respect to the Company's cybersecurity program include (i) identifying and managing cybersecurity risks, (ii) coordinating cybersecurity incident response, (iii) assessing the health and maturity of the Company's cybersecurity policies, procedures, and plans, including the program, and (iv) reporting overall progress to the Cybersecurity Committee and to the full Board of Directors.


text: For additional information regarding relevant cybersecurity risks, see Item 1A Risk Factors "A cyberattack targeting systems and infrastructure used by the Company or others in the oil and gas industry may adversely impact the Company's operations."


text: As a wholly owned subsidiary of APA, the Company relies on APA for its information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes undertaken by APA for assessing, identifying, and managing material risks from cybersecurity threats. The Company's executive officers are executive officers of APA, and one of such officers (John J. Christmann IV) is also a member of APA's board of directors (the APA Board of Directors).

companyName: APACHE CORP


text: APA maintains a cybersecurity program that establishes safeguards for protecting the confidentiality, integrity, and availability of APA's data, technology, and information systems, and the material risks associated with the threats identified from time to time under the cybersecurity program are incorporated into APA's corporate risk register. The program includes general controls for managing changes in and access to APA's information technology environment, cybersecurity awareness and training programs to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite APA's response in the event of a cybersecurity incident, and guidelines regarding system vulnerability management, third-party threat intelligence, endpoint detection and response solutions, and network security measures.


text: APA's Chief Information Officer (the CIO) is primarily responsible for the day-to-day operation of APA's cybersecurity program and for identifying, assessing, and managing the material risks associated with the cybersecurity threats and incidents identified from time to time thereunder.


text: In 2023, the APA Board of Directors established a standing Cybersecurity Committee to assist with oversight of APA's cybersecurity program and the material risks associated with the threats identified under the program. The Cybersecurity Committee receives regular reports from APA management, including the CIO, regarding APA's cybersecurity systems and programs, and the committee from time to time also receives updates from external cybersecurity specialists on cybersecurity trends and incidents.


text: As a regular part of our ordinary business operations, we collect and store data, including information necessary for our operations, information from our customers, employees, and our business partners. We recognize these networks and systems may be subject to increasing and continually evolving cybersecurity risks. Our Audit Committee is responsible for overseeing risk management and Cybersecurity is an integral part of the Company's overall risk management program. Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks.

companyName: Mediaco Holding Inc.

ticker: MDIA


text: Our management team is involved in assessing and managing the Company's material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Chief Technology Officer, Chief Financial Officer and General Counsel. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to our Board or to its Audit Committee.


text: As part of our risk management processes, we are developing risk assessments to identify the probability, immediacy, and potential magnitude of information security risks. Our internal experts regularly conduct audits and tests of our information systems, and our cybersecurity program is periodically assisted by established, independent third-party consultants, who provide assistance through tabletop and other preparedness exercises. Additionally, we review regular publications on cyber awareness and conduct ongoing simulated phishing exercises. We use the findings from these and other processes to improve our information security practices, procedures and technologies.


text: While we have not yet experienced any material impacts from a cyber-attack, any one or more future cyber-attacks could materially adversely impact the Company, including a loss of trust among our customers, departures of key employees, general diminishment of our reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands.


text: See the section titled Item IA. Risk Factors, including "Our business is dependent upon the proper functioning of our internal business processes and information systems. The modification, change of, or interruption of such systems may disrupt our business, processes and internal controls," for additional information about the risks from cybersecurity threats that may materially affect our business.


text: Our management team is involved in assessing and managing the Company's material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Chief Technology Officer, Chief Financial Officer and General Counsel. Our Senior Vice President of Information Technology and Infrastructure brings over 25 years of expertise in media, information security, technology risk management, spearheading our cybersecurity program. In close collaboration with the senior executive team, IT leadership is responsible for ensuring compliance, addressing identified risks, and driving comprehensive employee training initiatives. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to our Board or to its Audit Committee.


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes in coordination with our information technology function. Such processes include physical, procedural and technical safeguards, and routine review of our policies and procedures to identify risks and improve our practices. We conduct cybersecurity training and testing for all of our employees covering timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and we educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We engage third-party consultants to enhance our cybersecurity oversight and conduct penetration testing and vulnerability assessments. Further, we consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: Werewolf Therapeutics, Inc.

ticker: HOWL


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches" in the section titled "Risk Factors" in Part 1, Item 1A of this Annual Report.


text: Our Director of Operations leads the operational oversight of the company-wide cybersecurity strategy, policy, standards and processes. The Director of Operations role is currently held by an individual who has over two decades of professional IT management experience and possesses the requisite education, skills and experience expected to perform such a duty. In addition, our Director of Operations as well as leaders from our operations, finance, and legal departments, are responsible for documenting, reviewing, and assessing our cybersecurity processes, monitoring for cybersecurity incidents, and periodically reporting on cybersecurity risks and risk management to the audit committee of our board of directors. The audit committee of the board of directors provides oversight of our cybersecurity risk as part of its periodic review of enterprise risk management. The audit committee provides regular updates to our board of directors regarding such oversight, including updates on the status of ongoing cybersecurity projects, the results of cybersecurity risk assessments, and the emerging cybersecurity threat landscape. Additionally, the board of directors reviews our enterprise risk management processes periodically and is notified by management between management updates regarding significant new cybersecurity threats or incidents.


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes in coordination with our information technology function. Such processes include physical, procedural and technical safeguards, and routine review of our policies and procedures to identify risks and improve our practices. We conduct cybersecurity training and testing for all of our employees covering timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and we educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We engage third-party consultants to enhance our cybersecurity oversight and conduct penetration testing and vulnerability assessment s. Further, we consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.


text: We do not believe that there are currently any risks from known cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factors entitled "Our business could be negatively affected by cyberattacks or a deficiency in our cybersecurity" and "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches" in the section titled "Risk Factors" in Part 1, Item 1A of this Annual Report.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. Our Manager maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework (the "NIST CF") and the Azure Security Benchmark. In general, our Manager seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company's information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: As one of the critical elements of the Company's overall risk management, our Manager's cybersecurity program is focused on the following key areas:


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Manager's Director of Information Technology and Chief Compliance Officer and other members of management of our Manager that implement and oversee our Manager's cybersecurity program.


text: Risk Assessment: No less frequently than annually, our Manager completes an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate the Company's cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company and our Manager. To supplement our Manager's internal assessment, our Manager also periodically engages third-party consultants to assess system configurations through configuration review and penetration testing.


text: Technical Safeguards: Our Manager deploys technical safeguards that are designed to protect the Company's and our Manager's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Our Manager has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and such plans are tested and evaluated on a regular basis.


text: Our Manager maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of the Company's and the Manager's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Our Manager provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate our Manager's evolving information security policies, standards, processes and practices.


text: Our Manager engages in the periodic assessment and testing of our Manager's policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and creation and modification of polices and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Manager adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company and our Manager. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our Manager, including the Manager's Director of Information Technology.


text: The Manager's Director of Information Technology, in coordination with relevant senior management and personnel of the Manager, which includes our Manager's Chief Financial Officer, Senior Infrastructure Engineer, and Chief Compliance Officer, work to conceive, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's business continuity plan. To ensure the effectiveness of these controls, the Manager's technology team continually monitors, hardens, and evolves systems' security postures to model and mirror various security frameworks such as NIST CSF and Azure Security Benchmark. The Manager's Director of Information Technology will promptly notify our General Counsel of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.


text: The Manager's Director of Information Technology has served in various roles in information technology and information security for 25 years, including serving as Global Technology Manager at a multi-national publicly traded broker-dealer, and 15 years as the Director of Information Technology at a privately held financial services firm. The Manager's Director of Information Technology holds an undergraduate degree in biochemistry and has attained numerous information technology certifications over the years including Microsoft Certified Systems Engineer (MCSE) and Cisco Certified network Professional (CCNP). The Manager's Senior Infrastructure Engineer has over 20 years industry experience, holds an undergraduate degree in radiology, and has completed various Microsoft related information technology certifications. Combined, our Manager's information technology team has over 50 years of experience covering all major aspects of network architecture and management.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors—General Risks—We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay dividends."


text: As one of the critical elements of the Company's overall risk management, our cybersecurity program is focused on the following key areas:


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Manager's Director of Information Technology and other members of management of our Manager that implement and oversee our Manager's cybersecurity program.


text: Our Manager has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and the technological components of such plans are tested and evaluated on a regular basis.


text: Our Manager engages in the periodic assessment and testing of our Manager's policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Manager adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors—General Risks—We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay dividends."


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our customers, partners, and employees, including the importance of managing cybersecurity risks, and we have integrated these policies and procedures into our overall risk management systems and processes. While everyone at our company is expected to play a part in managing cybersecurity risks, our board of directors, as discussed in more detail under "—Governance" below, through delegation to the cybersecurity committee of the board of directors (the cybersecurity committee), and key members of our senior management team, are involved in the oversight of our information security program. Our information security program is based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards, and is integrated into our overall enterprise risk management program. We utilize an overarching framework to address enterprise information security governance, which seeks to protect information assets and systems against attacks and incidents while establishing appropriate security as a priority for our information technology infrastructure and throughout the product development process. Our information security team, including a "red team" of dedicated engineers, and certain cross-functional employees routinely assess material risks from cybersecurity threats, and assess and update our cybersecurity risk management program in response to emerging trends and changes in our operations. We also engage third parties, including consultants and auditors, to evaluate the effectiveness of our risk management program, control environment, and cybersecurity practices through security audits, penetration testing, and other engagements.

companyName: BILL Holdings, Inc.

ticker: BILL


text: Our information security program is managed by a dedicated Chief Information Security Officer (CISO), who reports to our Chief Technology Officer and oversees a team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our foundational security engineering, governance risk and compliance, product security and security operations teams report into our CISO and provide regular updates on significant or potentially significant threats and incidents. Our CISO has over 20 years of experience in information security, serving in roles of increasing responsibility within several public companies including companies in the cybersecurity and software fields. In addition, our Deputy CISO has nearly 20 years of experience serving in information security roles in healthcare and technology companies.


text: Our information security program includes an incident response program that coordinates activities across multiple teams in responding to cybersecurity incidents in accordance with a defined Incident Management Policy. This program is designed to detect, analyze, and escalate cybersecurity events, and includes a cybersecurity incident response team responsible for containment and recovery activities, and a crisis response team to liaise with business stakeholders, secure priority resources, and validate completion of any post-incident activities. In addition, we have established an executive security risk management committee composed of senior representatives of our legal, finance, information security, product, and marketing teams which meets on a quarterly basis to review our information security program and any noteworthy developments in the quarter. Finally, we coordinate internal simulations of cybersecurity incidents periodically to test the processes we have established.


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We conduct initial due diligence on the cybersecurity profile of our vendors as they are onboarded and provide continuous monitoring of critical third-party infrastructure and monitor any known breaches of those third-party systems. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, result of operations or financial condition. If we or our partners were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "We, our partners, our customers, and others who use our services obtain and process a large amount of sensitive data. Any real or perceived improper or unauthorized use of, disclosure of, or access to such data could harm our reputation as a trusted brand and adversely affect our business, operating results, and financial condition."


text: In light of the critical importance of cybersecurity to our business, in the spring of 2023, our board of directors formed a standing cybersecurity committee. The cybersecurity committee meets quarterly and is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. These reports include updates on our information security risks and threats, any notable incidents, escalations or third-party risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape and company security culture. The CISO provides reports at least quarterly to the cybersecurity committee as well as to our Chief Executive Officer, Chief Technology Officer, and other members of our senior management, as appropriate. The cybersecurity committee also receives quarterly updates from our legal department and third-party experts. Our cybersecurity committee provides regular updates to the board of directors on such reports, and coordinates with the audit committee of the board of directors with respect to any risks with implications for our financial reporting, accounting, internal controls or other matters presenting significant financial risk.