text: While our enterprise risk management program considers cybersecurity risks alongside other significant business risks, we also maintain robust cybersecurity processes, technologies, and controls to aid our efforts to identify, assess, and manage material risks posed to our Company. Annually, we conduct an information security risk assessment, and we periodically review our security architecture and assess third-party vendors that we use. We continuously monitor for security risks and vulnerabilities posed by the technological tools and people enabled processes we utilize. In addition, we employ a range of tools and services, including network and endpoint monitoring, third-party penetration testing, and periodic tabletop exercises to ensure timely discovery of, response to, and remediation of, security incidents. While we assess and monitor for security risks and vulnerabilities posed by our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that our assessment and monitoring of such third parties will prevent or mitigate the risk of any compromise or failure in the information assets they own or control.


text: Our internal security controls are designed to align with standards set by the National Institute of Standards and Technology, or NIST, and the International Organization for Standardization, or ISO. In addition, our security processes are assessed by the Federal Financial Institutions Examination Council, or FFIEC, due to our status as a cybersecurity provider to several financial institutions and financial services organizations. Our security processes also are tested or assessed in accordance with the Sarbanes-Oxley Act of 2002, compliance obligations under the Service Organization Control Type 2 auditing procedure, or SOC2, and applicable privacy laws, both in the United States and internationally.

companyName: SecureWorks Corp

secItem: Item 1C


text: Our internal security controls and our cybersecurity processes, technologies, and controls are governed by the Company's Chief Security Officer and Chief Information Security Officer, or CISO, who reports quarterly on security matters, including cybersecurity, to the Company's internal Enterprise Risk Committee. Our CISO has been with us since 2011 and has worked in cybersecurity for over 21 years. In addition, as a provider of cybersecurity offerings, we employ numerous leaders who have experience in the cybersecurity industry. All Company employees must complete required annual information security and privacy training, which are reviewed and updated annually. They also receive ongoing security awareness education through emails, presentations, and other available training materials on our intranet. Pursuant to the Board's oversight of the Company's operational risk management, the Board has designated authority and responsibility to its Audit Committee to regularly review our processes and procedures for managing cybersecurity risks and handling cybersecurity incidents. The Audit Committee receives quarterly updates from the CISO and others from the CISO's security team regarding our security programs, including a review of cybersecurity risks, threats, and vulnerabilities. Additionally, the Board of Directors receives an annual report on the cybersecurity threat landscape from at least one senior leader.


text: Our Company, through the leadership of the CISO, utilizes a variety of security governance and operational processes to manage our secure use of technology, including, but not limited to, the management of risks from insiders, third-parties, security controls, vulnerabilities, threats, and incident response.


text: We have adopted a comprehensive cybersecurity assessment framework, which is integrated into our security team's processes to ensure cybersecurity incidents are assessed and escalated in a timely manner, so that certain leaders within our organization further investigate, respond to, and remediate, the incident. Certain members of the Company's executive leadership team will also consider potentially applicable legal and regulatory obligations and take action to mitigate brand and reputational damage. In fiscal 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. If a cybersecurity incident is determined to be material, in accordance with reporting requirements applicable to us, our comprehensive cybersecurity assessment framework outlines our controls and the procedures adopted to ensure timely compliance with our reporting obligations.


text: The General Partner has written procedures and policies that govern the Partnership's general cybersecurity program. These policies and procedures include, among other things, the identification of risks, locations of information, management of third party risk and incident response, among other factors, and are designed to address real world concerns.

companyName: Millburn Multi-Markets Fund L.P.


text: The Cybersecurity Committee (the "Committee") of the General Partner is responsible for overseeing cyber and information security. The Committee meets at least quarterly to discuss cybersecurity risks and frequently holds more informal discussions in the interim. The Committee is subject to oversight by the board of directors of the General Partner (the "Board"). The Committee is co-chaired by the General Partner's President/Chief Operating Officer, Chief Technology Officer/Co-Head of Trading, and General Counsel/Chief Compliance Officer who oversee day-to-day implementation of cyber and information security by employees with specialized expertise and experience in such matters. The Board is kept apprised of the cybersecurity policies and procedures on a formal basis at least annually, and is kept informed on a less formal basis through participation in training and policy updates. The Committee meets at least quarterly to discuss and review testing, cybersecurity risks/events and all other relevant matters. Committee members are given the opportunity at these meetings to ask questions of all relevant personnel.


text: The General Partner utilizes a combination of statistics, data and testing by third party service providers and software in order to monitor and identify cybersecurity threats. To the extent those threats require immediate attention, they are dealt with and reported to the Committee thereafter in accordance with the procedures outlined in the General Partner's incident response plan. Other threats, as well as follow ups once threats are properly dealt with, are then discussed and analyzed by the Committee. Reports on these activities are discussed with the Board on at least an annual basis, with any material issues raised promptly to the Board as well.


text: To assess the effectiveness of the General Partner's cybersecurity programs and to mitigate exposure, the General Partner has consulted with strategic partners, such as outside counsel specializing in this subject matter as well as the General Partner's cyber insurance provider. The General Partner also undertook a table top exercise designed to identify and mitigate issues and train personnel.


text: The General Partner's head of risk management (who is also mentioned above as one of the co-chairmen of the Committee) participates in all Committee meetings and, as part of the risk management function, the Committee applies principles of risk management to its information security program. As with all risks identified by the General Partner, risks are identified and evaluated, with higher risk items receiving priority attention.


text: The General Partner has undertaken efforts to mitigate cyber risks and their impact, including, but not limited to, certain implementation of firewalls, anti-virus/anti-malware, controls around remote network access, multi-factor authentication, system event monitoring and notifications and electronic surveillance, frequent backups, encryption and password protection, education and testing, supervision of third parties, limitations on access, vulnerability scanning, patch installation, physical safeguards, virus scanning, and penetration testing.


text: Employees are required to complete initial cybersecurity training upon commencement of employment and, thereafter, on an annual basis. The training is designed by a third party service provider. The General Partner carries cyber insurance. The General Partner maintains formal cybersecurity procedures that are considered during contract review with respect to third party vendors handling and having access to information.


text: The General Partner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner or the Partnership's business strategy, results of operation or financial condition. Nonetheless, there is no guarantee that a future cyber incident would not materially affect the General Partner or the Partnership's business strategy, results of operations or financial condition. Despite the various efforts the General Partner has undertaken to mitigate cyber risks and their impact, systems, networks and/or devices potentially can be breached. Such cybersecurity breaches may cause: (i) disruptions and impacts to business operations, potentially resulting in financial losses to the Partnership and limited partners; (ii) interference with the General Partner's ability to calculate the value of an investment; (iii) impediments to trading; (iv) the inability of the Partnership and its service providers to transact business; (v) violations of applicable privacy and other laws; (vi) regulatory fines, penalties, reputational damage, reimbursement or other compensation costs or additional compliance costs; and (vii) the inadvertent release of confidential information. Similar adverse consequences could result from cybersecurity breaches affecting counterparties with which the Partnership engages in transactions; governmental and other regulatory authorities; exchange and other financial market operators, banks, brokers, dealers, insurance companies and other financial institutions; and other parties. In addition, substantial costs may be incurred by these entities in order to prevent any cybersecurity breaches in the future. The nature of malicious cyber-attacks is becoming increasingly sophisticated and the Partnership cannot control the cyber systems and cybersecurity systems of counterparties or third party service providers. While, to date, we have not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition, the preventive actions we take to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Sunrun Inc.

ticker: RUN


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigation strategies. We employ various tools and services for such purposes, including network, cloud and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. We also have a cybersecurity risk assessment process, which helps identify our cybersecurity threat risks by considering certain industry standards as well as by engaging third parties to assess the security posture of our information security program.


text: To manage our material risks from cybersecurity threats, we take certain measures, including the below listed activities, depending on the nature of the relevant systems, data, and environment: • undertaking period reviews of our consumer-facing policies and statements; • conduct phishing email simulations for employees and contractors with access to corporate email systems; • require employees, and certain service providers, to treat customer information with care; • running tabletop exercises to simulate a response to a cybersecurity incident; • carrying cybersecurity insurance that provides protection against the potential losses arising from a cybersecurity incident; • conducting annual cybersecurity awareness training for employees; and • maintaining an incident response plan to prepare for, detect, respond to, and recover from, cybersecurity incidents.


text: As part of our efforts to identify, assess, and manage material risks from cybersecurity threats, we engage third-party cybersecurity consultants and use them to, among other things, conduct a review of our cybersecurity program or conduct a tabletop exercise to help identify areas for continued focus, improvement and/or compliance.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers, including those in our supply chain, which also include, but are not limited to, open-source software in our application development processes, or those who have access to our customer and employee data or our systems. Addressing these risks is part of our enterprise risk management program. Cybersecurity risks affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our critical systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we may impose contractual requirements related to cybersecurity on certain third parties that could pose significant cybersecurity risk to us and require them to agree to audits as appropriate.


text: We describe the risks from cybersecurity threats that may materially affect us and how they may do so under the heading "Risks Related to Our Business Operations" under Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our approach is to treat cybersecurity not just as a technology issue, but to recognize that it can have wide-ranging impacts on the business, operations, and financials of our company.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and receives updates from management quarterly. At least annually, the entire Board receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee and Board generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer (CISO) in connection with our Chief Technology Officer, Chief Legal and People Officer, our Senior Vice President of Legal and Vice President, Internal Audit. Such individuals have extensive prior work experience and expertise spanning over three decades in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing cybersecurity operations and incident response, and incorporating security and privacy by design into software development programs, and our CISO has both CISSP and CRISC certifications.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: As discussed above, these members of management report to the entire Board about cybersecurity threat risks, among other cybersecurity related matters at least annually, with updates to the Audit Committee on a quarterly basis.


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigation strategies. We employ various tools and services for such purposes, including network, cloud and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. We also have a cybersecurity risk assessment process, which surfaces cybersecurity risks by measuring our posture against industry standards and engaging third parties to assess our information security program.


text: To manage our material risks from cybersecurity threats, we take certain measures, including the below listed activities, depending on the nature of the relevant systems, data, and environment: • undertaking period reviews of our consumer-facing policies and statements; • conduct phishing security training for employees and contractors with access to corporate email systems; • require employees, and data service providers with whom we share customer, employee or partner data, to treat customer information with care; • running tabletop exercises to simulate a response to a cybersecurity incident; • carrying cybersecurity insurance that provides protection against the potential losses arising from a cybersecurity incident; • conducting annual cybersecurity awareness training for employees; and • maintaining an incident response plan to prepare for, detect, respond to, and recover from, cybersecurity incidents.


text: As part of our efforts to identify, assess, and manage material risks from cybersecurity threats, we engage third-party cybersecurity consultants and use them to, among other things, conduct a review of our cybersecurity program or conduct a tabletop exercise to help identify areas for continued focus, improvement and/or compliance. In addition to maintaining a robust incident response plan, we regularly test our response capabilities through real-world simulations, post-incident reviews, and lessons-learned exercises to ensure continuous improvement in our ability to respond effectively to cybersecurity incidents.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers, including those in our supply chain, which also include, but are not limited to, open-source software in our application development processes, or those who have access to our customer and employee data or our systems. Our cybersecurity program is closely aligned with our commitment to data privacy. We adhere to applicable data protection laws and regulations, integrate privacy-by-design principles into our processes, and routinely assess our practices to ensure that we protect customer, employee, and partner information. Addressing these risks is part of our enterprise risk management program. Cybersecurity risks affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our critical systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we may impose contractual requirements related to cybersecurity on certain third parties that could pose significant cybersecurity risk to us and require them to agree to audits as appropriate.


text: Cybersecurity Incidents During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we have encountered routine cybersecurity threats and attempted attacks, such as phishing emails and malware attempts, our security measures have effectively mitigated these risks without causing material disruption.


text: Despite our efforts, the risk of cybersecurity incidents remains, and we continue to monitor, adapt and enhance our security posture to address evolving threats. Any future cybersecurity breaches or system vulnerabilities could impact our business operations, reputation and regulatory compliance obligations. We remain committed to maintaining a robust cybersecurity program to mitigate these risks.


text: We provide disclosures on the potential material impacts of cybersecurity threats on our business operations, which are detailed under the heading 'Risks Related to Our Business Operations' in Item 1A of this Annual Report on Form 10-K, and those disclosures are incorporated by reference herein.


text: Cybersecurity is a critical component of our enterprise risk management framework and a key area of focus for both our Board and management. Our approach is to treat cybersecurity not just as a technology issue, but to recognize that it can have wide-ranging impacts on the business, operations, and financials of our company.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and receives updates from management quarterly. At least annually, the entire Board receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee and Board generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also integrated into Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our VP Information Security in connection with our Chief Technology Officer, Chief Legal and People Officer, our Senior Vice President of Legal and Vice President, Internal Audit. Such individuals have extensive prior work experience and expertise spanning over three decades in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing cybersecurity operations and incident response, and incorporating security and privacy by design into software development programs.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including credit, market, treasury, operational, compliance, model and data, and reputational. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity component and is a key member of the organization, reporting directly to the Chief Information Officer and, as discussed below, periodically to the Innovation and Technology Committee of our board of directors. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity program that is intended to comply with Gramm-Leach-Bliley Act (GLBA) 12 CFR 364, Appendix B, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The cybersecurity program is built upon a foundation of advanced security technology, our internal employee team, and operations based on industry best practices recommendations from the National Institute of Standards and Technology (NIST) Cybersecurity Framework, Federal Financial Institutions Examination Council (FFIEC) Guidelines, and Center for Internet Security (CIS) Benchmarks. This consists of controls designed to identify, protect, detect, respond and recover from information and cyber security incidents. Our Chief Information Security Officer and our Chief Information Officer, who reports directly to our Chief Executive Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely.


text: The Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. To mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Third-Party Risk Management Program, which is implemented through a Third-Party Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Third-Party Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Third-Party Risk Management Program is audited periodically in accordance with our Board approved Internal Audit plan.


text: We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our information security and risk management programs. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: We maintain both an Incident Response Plan and a Crisis Management Plan (the "Plans") that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Innovation and Technology Committee of our board of directors. The Plans are coordinated through the Business Resiliency Manager and Major Incident Manager, who ultimately report to the Chief Information Officer, and key members of management are embedded into the Plans by their design. The Plans facilitate coordination across multiple parts of our organization and are evaluated at least annually. Integral elements of the Plans related to the Company's response to security vulnerabilities include the following.


text: • Identifying the appropriate team and any appropriate sub-teams to address specific information and/or cyber security incidents, or categories of information and/or cyber security incidents. • Coordinating Incident or Crisis Management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information and/or cyber security incidents. • Conducting post-incident reviews to gather feedback on information and/or cyber security incident response procedures and address any identified gaps in security measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plans. • Reviewing the Plans at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Operational Matters" in Item 1A. Risk Factors.


text: Our Chief Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, cyber incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third-party risk management and business resilience as it relates to the cybersecurity program.


text: The foregoing responsibilities are covered on a day-to-day basis by our Chief Information Security Officer and their team. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. Our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 20 years of cybersecurity experience, 12 of which was spent at the Company.


text: Our Operational Risk Management group provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer.


text: Our board of directors has established management committees including the Information Technology Steering Committee, which focuses on technology and business impact, and the Operational Risk Management Committee, which focuses on the identification, monitoring, assessment, and management of risk associated with our cyber and information security programs. These committees provide oversight and governance of the technology program and the information security program and are chaired by the Chief Information Officer and Chief Operational Risk Management Officer, respectively, and include the Chief Information Security Officer and other key departmental managers from throughout the entire company. The Information Technology Steering Committee meets monthly and the Operational Risk Management Committee meets at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan to facilitate timely informing and monitoring efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity incidents, discussed at committee meetings and the actions taken to the Innovation and Technology Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The Innovation and Technology Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer and our Chief Information Officer provide quarterly reports to the Innovation and Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Innovation and Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews key metrics summarizing our cyber security risk profile on a quarterly basis. The Innovation and Technology Committee and Risk Committee of our board of directors each provide a report of their activities to the full board of directors at each board meeting.


text: Lastly, at least annually, the CISO reports directly to the Board the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including credit, market, treasury, operational, compliance, model and data, and reputational risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for system failure, interruption, or a cybersecurity breach to occur, which could disrupt business operations or compromise confidential, personal, sensitive or proprietary information. Our CISO is primarily responsible for this cybersecurity component and is a key member of the organization, reporting directly to the CIO (who then reports directly to our Chief Executive Officer) and, as discussed below, periodically to the Innovation and Technology Committee, Enterprise Risk Committee and to our Board of Directors. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.


text: In an effort to prepare for and respond to system failures, interruptions or cybersecurity breaches, the Company has implemented a multi-layered cybersecurity program that integrates people, technology, and processes and is intended to comply with the information security standards established pursuant to the Gramm-Leach-Bliley Act (GLBA) 12 CFR 364, Appendix B. This cybersecurity program includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management, and incident response. Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts that penetrate, disrupt or misuse our systems or information. The cybersecurity program is built upon a foundation of advanced security technology, our internal employee team, and operations based on industry best practice and recommendations from the National Institute of Standards and Technology (NIST) Cybersecurity Maturity Framework, Federal Financial Institutions Examination Council (FFIEC) Guidelines, and Center for Internet Security (CIS) Benchmarks. This consists of controls designed to govern, identify, protect, detect, respond and recover from system failures, interruptions, and cybersecurity breaches. Our CISO and our CIO, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The cybersecurity program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We also employ a variety of preventative and monitoring tools designed to monitor, block, and provide alerts regarding suspicious activity including suspected. We have established processes and systems designed to mitigate cybersecurity risk, including regular and ongoing education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also actively monitor our email gateways for incoming and outgoing malicious emails and monitor remote connections as a significant portion of our workforce has the option to work remotely.


text: The Company relies on third-party vendor solutions to support its operations. Many of these their-party vendors, especially in the financial services industry, have access to confidential, personal, sensitive and proprietary information. To mitigate the cyber, privacy and other operational risks associated with the use of third-party vendors, the Company maintains a third-party risk management program, which is implemented through a third-party risk management policy and includes a detailed onboarding process and periodic reviews of third-party vendors with access to confidential, personal, sensitive and propriety information. The third-party risk management policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in alignment with the Interagency Guidance on Third-Party Relationships: Risk Management. The third-party risk management program is audited periodically in accordance with our Board approved internal audit plan.


text: We leverage internal and third-party auditors and independent third-party sources to periodically review our processes, systems, and controls related to our cybersecurity security program. This includes assessing control design and operating effectiveness and recommendations to strengthen our cybersecurity program. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: We maintain both an incident response plan and a crisis management plan (the "Plans") that provide a documented framework for responding to actual or potential system failures, interruptions, or cybersecurity breaches, including timely notification of and escalation to the appropriate Board-approved management committees as discussed further below. The Plans are coordinated through the Business Resiliency Manager and Major Incident Manager, who ultimately report to the CISO and the CIO respectively, and key members of management who are embedded into the Plans by their design. The Plans facilitate coordination across multiple parts of our organization and are evaluated at least annually.


text: Integral elements of the Plans related to the Company's response to cybersecurity vulnerabilities include the following: • Identifying the appropriate team and any appropriate sub-teams to address specific system failures, interruptions, or cybersecurity breaches, or categories thereof. • Coordinating incident or crisis management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified system failures, interruptions, or cybersecurity breaches. • Conducting post-incident reviews to gather feedback on incident response procedures and address any identified gaps in cybersecurity measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plans. • Reviewing the Plans at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its incident response procedures.


text: Not withstanding our defensive measures and processes, the threats posed by system failures, interruptions, or cybersecurity breaches are severe. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Operational Matters" in Item 1A. Risk Factors.


text: Our CISO is accountable for managing our enterprise cybersecurity department and delivering our cybersecurity program. The responsibilities of this department include privacy, resiliency, cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third-party risk management and business resilience as it relates to the cybersecurity program.


text: The foregoing responsibilities are covered on a day-to-day basis by our CISO and their team. The cybersecurity department consists of cybersecurity professionals with varying degrees of education and experience. Individuals within the cybersecurity department are generally subject to professional education and certification requirements. Our CISO has substantial relevant expertise and formal training in the areas of cybersecurity risk management, including 25 years of cybersecurity experience in the financial services, retail, insurance sectors.


text: Our Board of Directors has established management committees including the Innovation and Technology Steering Committee (ITSC), which focuses on overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks, and the Operational Risk Management Committee, which focuses on the identification, monitoring, assessment, and management of risk associated with our cybersecurity program. These committees provide oversight and governance of the cybersecurity program and are chaired by the CIO and Chief Operational Risk Management Officer, respectively, and include the CISO and other key departmental managers from throughout the Company. The ITSC meets quarterly and the Operational Risk Management Committee meets at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage cybersecurity risks. More frequent meetings occur from time to time in accordance with the incident response plan to facilitate timely informing and monitoring efforts. The CISO reports summaries of key issues, including significant system failures, interruptions or cybersecurity breaches, discussed at committee meetings and the actions taken to the Innovation and Technology Committee of our Board of Directors on a quarterly basis (or more frequently as may be required by the incident response plan). Additionally, the Chief Operational Risk Management Officer reports summaries of key cybersecurity risks to the Risk Committee of our Board of Directors on a quarterly basis.


text: The Innovation and Technology Committee of our Board of Directors is responsible for overseeing our cybersecurity program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our CISO and our CIO provide quarterly reports to the Innovation and Technology Committee regarding our cybersecurity program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Innovation and Technology Committee reviews and approves our cybersecurity and technology budgets and strategies annually. Additionally, the Risk Committee of our Board of Directors reviews key metrics summarizing our cybersecurity risk profile on a quarterly basis. The Innovation and Technology Committee and Risk Committee each provide a report of their activities to our full Board of Directors at each Board meeting.


text: Lastly, at least annually, the CISO reports directly to our Board of Directors the overall status of the cybersecurity program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, system failures, interruptions or cybersecurity breaches are discussed as are management's responses and any recommendations for program changes.


text: Since the closing of the Transfer Agreement, we have been a shell company with nominal operations and assets and our sole business activity has been to seek, investigate, and, if warranted, acquire an interest in a business opportunity. Therefore, we do not believe that we face significant cybersecurity risk.

companyName: Agassi Sports Entertainment Corp.

ticker: AASP


text: have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we depend on the digital technologies of third-party IT service providers, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our Board of Directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the Board of Directors deems have not encountered any cybersecurity incidents since the closing of the Transfer Agreement."


text: The Company's cyber risk management strategy has consisted of a focus on minimizing our attach surface and leveraging industry standard cyber threat prevention, detection, and remediation tools. The Company assesses cyber security risk as follows:

companyName: REGENEREX PHARMA, INC.

ticker: RGPX


text: We have executed on this strategy with a cloud-first approach, awareness training, and deliberate use of well-established vendors for software and hardware solutions.


text: The Company's IT manager is engaging an independent service with its expertise specifically in cybersecurity and risk mitigation to review our IT as a risk service consultant. To date, no cybersecurity threats have materially affected our business strategy, operations, or financial condition.


text: The Company's cyber risk management strategy has consisted of a focus on minimizing our attach surface and leveraging industry standard cyber threat prevention, detection, and remediation tools.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including financial, operational, regulatory, reputational, and legal. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are integrated into the Company's ERM program and are based on recognized frameworks established by the Federal Financial Institutions Examination Council and other industry recognized standards. Our Chief Information Security Officer ("CISO"), who reports directly to the Bank's Chief Risk Officer ("CRO"), along with key members of his team, regularly collaborates with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues to identify best practices. The information security program is periodically reviewed by the Bank's CISO with the goal of addressing changing threats and conditions. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program and strategy is focused on the following key areas: • Governance—As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee") and by the Technology Committee of the Board (the "Technology Committee"), which regularly interacts with the Company's ERM function, CRO, Chief Information Officer ("CIO"), CISO and other members of management and relevant management committees. In recognition of the evolving landscape of cyber threats and the critical importance of safeguarding our digital assets and customer information, the Bank has taken proactive steps to enhance our cybersecurity framework and risk management practices. Central to these efforts is the expertise and oversight provided by the Board, particularly through the involvement of its Technology Committee. This committee is composed of directors with significant experience in technology and cybersecurity, working to align our cyber risk management strategies with best practices and industry standards. • Technical Safeguards—The Company deploys layered technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through penetration testing, vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning—The Company has implemented a robust, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. To that end, the Company has established and maintains a comprehensive cybersecurity incident response plan that establishes a structured approach for the Company's response to a cybersecurity incident, such plan is tested and evaluated on a regular basis. The Company has implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Outside Experts—The Company routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Third-Party Risk Management—The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness—The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee of the Board, the Risk Committee, the Technology Committee and the Board. The Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant. For more information on the Company's cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third-Parties and Technology." The prior incidents enabled us to enhance our operational and cybersecurity risk management practices. The lessons learned have also informed our approach to conducting tabletop exercises simulating potential cyber threats, allowing the Bank to assess and improve our response protocols.


text: The Board, in coordination with the Risk Committee and Technology Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Technology Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews. The CRO reports to the Technology Committee and management committees information regarding cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board, Technology Committee and appropriate management committees review the Company's approach to cybersecurity risk management through reporting by the CISO. The Technology Committee and the Board approve the Information Security Program and all supporting Policies.


text: The CISO, in coordination with the Bank's CRO, CIO and General Counsel, works across the Company to implement and monitor a program designed to protect the Company's information systems from cybersecurity threats and promptly respond to any cybersecurity incidents in accordance with the Company's cybersecurity incident response plan. The Company has recently bolstered cybersecurity leadership, with the addition of a Director of Information Security Officer ("DISO"). The DISO possesses a wealth of experience in the field of information security, notably having served as a regulator in charge of information security for over seven years. This background provides the DISO with a deep understanding of cybersecurity challenges and regulatory requirements faced by financial institutions. This expertise is invaluable in enhancing our cyber defenses and ensuring our compliance with stringent regulatory standards.


text: The Company's CISO has served in various roles in information technology and information security for over twenty years, including serving as a Cyberspace Operations Officer in the United States Air Force Reserves and instructing for the SANS Technology Institute. The Company's CISO holds an undergraduate degree in Business Administration and has attained the professional certification of Certified Information Systems Security Professional ("CISSP") and numerous GIAC certifications. The Company's CRO has over a 25-year career in the banking industry and is currently serving as Senior Executive Vice President and Chief Risk Officer of Stellar Bank and Chief Risk Officer of Stellar Bancorp, Inc. Previously, the CRO has held the positions of President and Chief Risk Officer at Allegiance Bank and Executive Vice President and Chief Risk Officer at Allegiance. The Company's CRO's banking career as an executive started at Independence Bank in 2002 as Senior Credit Officer and eventually was promoted to President in 2009. Between 2010 and 2013, the CRO also served as CEO of Independence Bank until joining Allegiance Bank following a merger. The Company's CRO has since assumed the roles of Regional President, Deputy Chief Credit Officer, and Chief Administration Officer at Allegiance Bank. The CRO holds an MBA from the University of Houston and a Bachelor of Arts in Finance & Marketing from the same institution.


text: The Company's CEO, CFO and GC each hold undergraduate and/or graduate degrees in their respective fields, and each have significant experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The members of the Boards of Directors of the Company and the Bank have hundreds of combined years of experience running successful companies and managing enterprise risk. Specific cybersecurity expertise is brought to the Board from independent directors who lead or have led technology firms and, as such, have direct managerial oversight of cybersecurity risks.


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program and strategy is focused on the following key areas: • Governance—As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee") and by the Technology Committee of the Board (the "Technology Committee"), which regularly interacts with the Company's ERM function, CRO, Chief Information Officer ("CIO"), CISO and other members of management and relevant management committees. In recognition of the evolving landscape of cyber threats and the critical importance of safeguarding our digital assets and customer information, the Bank has taken proactive steps to enhance our cybersecurity framework and risk management practices. Central to these efforts is the expertise and oversight provided by the Board, particularly through the involvement of its Technology Committee. This committee is composed of directors with significant experience in technology and cybersecurity, working to align our cyber risk management strategies with best practices and industry standards. • Technical Safeguards—The Company deploys layered technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through penetration testing, vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning—The Company has implemented a robust, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. To that end, the Company has established and maintains a comprehensive cybersecurity incident response plan that establishes a structured approach for the Company's response to a cybersecurity incident, such plan is tested and evaluated on a regular basis. The Company has implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Outside Experts —The Company routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Third-Party Risk Management —The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness—The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant. For more information on the Company's cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third-Parties and Technology." Any prior incidents enabled us to enhance our operational and cybersecurity risk management practices. The lessons learned have also informed the Company's approach to conducting tabletop exercises simulating potential cyber threats, allowing the Company to assess and improve its response protocols.


text: The Board, in coordination with the Risk Committee and Technology Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Technology Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews. The CISO reports to the Board Risk Committee, Technology Committee and management committees information regarding cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board, Technology Committee and appropriate management committees review the Company's approach to cybersecurity risk management through reporting by the CISO. The Technology Committee and the Board approve the Information Security Program and all supporting policies.


text: The CISO, in coordination with the CRO, CIO and General Counsel, works across the Company to implement and monitor a program designed to protect the Company's information systems from cybersecurity threats and promptly respond to any cybersecurity incidents in accordance with the Company's cybersecurity incident response plan. The Company's CISO has served in various roles in information technology and information security for over twenty years, including serving as a Cyberspace Operations Officer in the United States Air Force Reserves and instructing for the SANS Technology Institute. The Company's CISO holds an undergraduate degree in Business Administration and has attained the professional certification of Certified Information Systems Security Professional ("CISSP") and multiple GIAC certifications. The Company's CRO has over a 25-year career in the banking industry and is currently serving as Senior Executive Vice President and Chief Risk Officer of Stellar Bank and Chief Risk Officer of Stellar Bancorp, Inc. Previously, the CRO has held the positions of President and Chief Risk Officer at Allegiance Bank and Executive Vice President and Chief Risk Officer at Allegiance. The Company's CRO's banking career as an executive started at Independence Bank in 2002 as Senior Credit Officer and eventually was promoted to President in 2009. Between 2010 and 2013, the CRO also served as CEO of Independence Bank until joining Allegiance Bank following a merger. The Company's CRO has since assumed the roles of Regional President, Deputy Chief Credit Officer, and Chief Administration Officer at Allegiance Bank. The CRO holds an MBA from the University of Houston and a Bachelor of Arts in Finance & Marketing from the same institution.


text: The Company's CEO, CFO and General Counsel each hold undergraduate and/or graduate degrees in their respective fields, and each have significant experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The members of the Boards of Directors of the Company and the Bank have hundreds of combined years of experience running successful companies and managing enterprise risk. Specific cybersecurity expertise is brought to the Board from independent directors who lead or have led technology firms and, as such, have direct managerial oversight of cybersecurity risks.


text: We have identified cybersecurity risk as one of our key enterprise risks. One of our Co-Presidents is responsible for managing cybersecurity risk. They develop mitigation strategies and implement controls to reduce the likelihood of a cybersecurity incident occurring and to reduce the impact of such an incident should it occur. At least annually, they report on this risk and their mitigation work to the Audit Committee of our Board of Trustees, which is the committee that has primary responsibility for overseeing our enterprise risk management program and is composed solely of independent trustees. The Audit Committee reviews and discusses all of our key enterprise risks, including cybersecurity risk, and the enterprise risk management program itself. The chair of the Audit Committee may, at their discretion, report to the Chairman of the Board or the full Board of Trustees regarding any aspect of the program or risks.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: As of December 31, 2023, no risk from cybersecurity threats, including as a result of any previous cybersecurity incident, has materially affected our business, results of operations or financial condition. Although we have invested in the protection of our data and information systems and the monitoring of our systems on an ongoing basis, such efforts may not in the future prevent material compromises to our information systems, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with external advisors regarding opportunities and enhancements to strengthen our policies and practices.


text: We have elected to outsource our information technology function to a third-party managed service provider, or the MSP, that specializes in fully managed information technology services and fully managed cybersecurity. The MSP is responsible for managing all of our hosted services, all of the computer and computer-related hardware and software we use, and all onsite and offsite backups. The MSP also provides managed security services designed to prevent cybersecurity threats, to identify and remediate vulnerabilities, to monitor systems 24/7, to protect data and systems, to detect potential intrusions and cybersecurity incidents, to quarantine systems should they be compromised, and to recover from business interruptions or other disasters. The MSP follows the NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology of the U.S. Department of Commerce, to measure the maturity of the services it provides to us and its other clients.


text: The MSP and we developed a cybersecurity incident response plan that sets forth roles and responsibilities for the identification, assessment, triage, communication and resolution of cybersecurity incidents.


text: In addition, the MSP performs facility and system penetration tests, compromise assessments and security maturity assessments of our corporate and operational networks. In collaboration with the MSP, we maintain a comprehensive cybersecurity training program to help our personnel identify and assist in mitigating cybersecurity risks. Our executive officers and employees participate in annual training with additional issue-specific training as needed.


text: While we have control, through our contract with the MSP, over our information systems, we do not have control over the information systems of our hotel managers, which are the third-party operators of our hotels and resorts, or of our franchisors. Although we set clear expectations of our hotel managers and franchisors, we rely on our hotel managers and franchisors for managing their cybersecurity risk. We conduct surveys of our hotel managers and franchisors to assess their cybersecurity risk management programs and procedures, to identify gaps and request remediation and to understand our risk exposure. Many of our hotel managers and franchisors carry cyber insurance policies to protect and offset a portion of potential costs incurred from a security breach. Additionally, we currently have cyber insurance policies to provide supplemental coverage above the coverage carried by our hotel managers and franchisors.


text: For additional information about cybersecurity risk, see "Item 1A. Risk Factors—Our hotel managers and we rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business."


text: We have identified cybersecurity risk as one of our key enterprise risks. One of our Co-Presidents is responsible for managing cybersecurity risk. He develops mitigation strategies and implements controls to reduce the likelihood of a cybersecurity incident occurring and to reduce the impact of such an incident should it occur. At least annually, he reports on this risk and related mitigation work to the Audit Committee of our board of trustees, which is the committee that has primary responsibility for overseeing our enterprise risk management program and is composed solely of independent trustees. The Audit Committee reviews and discusses all of our key enterprise risks, including cybersecurity risk, and the enterprise risk management program itself. The chair of the Audit Committee may, at his discretion, report to the Chairman of the Board or the full board of trustees regarding any aspect of the program or risks.


text: As of December 31, 2024, no risk from cybersecurity threats, including as a result of any previous cybersecurity incident, has materially affected our business, results of operations or financial condition. Although we have invested in the protection of our data and information systems and the monitoring of our systems on an ongoing basis, such efforts may not in the future prevent material compromises to our information systems, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with external advisors regarding opportunities and enhancements to strengthen our policies and practices.


text: We have elected to outsource our information technology function to a third-party managed service provider, ("MSP") that specializes in fully managed information technology services and fully managed cybersecurity. The MSP is responsible for managing all of our hosted services, all of the computer and computer-related hardware and software we use, and all onsite and offsite backups. The MSP also provides managed security services designed to prevent cybersecurity threats, to identify and remediate vulnerabilities, to monitor systems 24/7, to protect data and systems, to detect potential intrusions and cybersecurity incidents, to quarantine systems should they be compromised, and to recover from business interruptions or other disasters. The MSP follows the NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology of the U.S. Department of Commerce, to measure the maturity of the services it provides to us and its other clients.


text: While we have control, through our contract with the MSP, over our information systems, we do not have control over the information systems of our hotel managers, which are the third-party operators of our hotels and resorts, or of our franchisors. We set clear expectations of our hotel managers and franchisors regarding cybersecurity, but we rely on our hotel managers and franchisors for managing their cybersecurity risk. We conduct surveys of our hotel managers and franchisors to assess their cybersecurity risk management programs and procedures, to identify gaps and request remediation and to understand our risk exposure. Many of our hotel managers and franchisors carry cyber insurance policies to protect and offset a portion of potential costs incurred from a security breach. Additionally, we currently have cyber insurance policies to provide supplemental coverage above the coverage carried by our hotel managers and franchisors.


text: Our broader information security program aims to secure our systems, keep our business running, and protect our client partners, field talent, team members, and shareholders from vulnerabilities and threats by protecting against, detecting, and recovering from cybersecurity incidents. With oversight from our Board, the Audit Committee, and management, we have put proactive measures and systems in place in an effort to protect our information assets from unauthorized use or access. Our cybersecurity framework is based on the National Institute of Standards and Technology ("NIST").

companyName: BGSF, INC.

ticker: BGSF


text: Our CIO and key members of senior management are accountable for our cybersecurity and data privacy programs and is supported by the Board of the Directors (the "Board"). Our CIO has extensive information technology and program management experience and has served many years in our corporate information security organization. Under the guidance of the Board, the CIO manages day-to-day operations of the security and data privacy functions and proposes changes to our cybersecurity strategy, which is part of our overall information technology strategy. The CIO and the Board meet frequently to discuss cyber and data operations, privacy programs and risks.


text: Our IT department monitors and manages system infrastructure in an effort to protect us against threats. Our cybersecurity process considers risks from many sources including, but not limited to, alerts, threat intelligence sources, risk assessments, and vulnerability management. Our cybersecurity process includes a risk assessment procedure, a risk evaluation procedure, and a third-party partner to strengthen our cybersecurity controls. These controls are designed to block and/or provide alerts on suspicious activities. Our security team responds as appropriate to risks identified.


text: The Board is actively engaged in the oversight of cybersecurity and data privacy. On a quarterly basis, the Board receives updates on (a) our progress on security improvement objectives, (b) relevant reported cybersecurity internal incidents and the global evolving risks, and (c) results of work performed by our third-party information security partner. We engage subject matter experts in conducting independent assessments of our cybersecurity program maturity, penetration tests, and other tests and assessments.


text: Many of our information technology systems and networks are cloud-based or managed by third parties, whose future performance and reliability we cannot control. The risk of a cyberattack or security breach on a third party carries the same risks to us as those associated with our internal systems. We seek to reduce these risks by performing significant vendor due diligence procedures prior to engaging with any third-party vendor who will have access to sensitive data. Additionally, we require annual audits of certain third parties' information technology processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business strategy. See "Risks Related to Our Information Technology, Cybersecurity and Data Protection" in Part 1, Item 1A. Risk Factors of this report for a discussion of these risks. With respect to our cybersecurity process, we are not aware of any material breach to date.


text: Key members of senior management, including our Chief Information Officer ("CIO"), are accountable for our cybersecurity and data privacy programs and is supported by the Board of the Directors (the "Board"). Under the guidance of the Board, our IT department, under the direction of our CIO, manages day-to-day operations of the security and data privacy functions and proposes changes to our cybersecurity strategy, which is part of our overall information technology strategy. The senior management, including our CIO, and the Board meet frequently to discuss cyber and data operations, privacy programs and risks. Our CIO has extensive information technology and program management experience and has served many years in our corporate information security organization.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Eventbrite, Inc.

ticker: EB


text: We design and assess our program using several industry-leading frameworks including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), Payment Card Industry Data Security Standard ("PCI-DSS''), and SOC2. With regards to the NIST CSF, this does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT infrastructure; • security controls intended to protect against, detect, and respond to cybersecurity threats, and a security team principally responsible for managing our (1) security controls, (2) cybersecurity risk assessment processes, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives occasional briefings from management on our cyber risk management program. Our board of directors receives presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 40 years of combined cybersecurity experience across architecture, engineering, operations and compliance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We design and assess our program using several industry-leading frameworks including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standard (PCI-DSS'), and SOC2. With regards to the NIST CSF, this does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, or our operations, business strategy, results of operations, or financial condition, including as a result of any prior cybersecurity incidents.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives occasional briefings from management on our cyber risk management program. Our board of directors receives presentations on cybersecurity topics from our Chief Information Security Officer (CISO), internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our management team, including our CISO, is responsible for assessing and managing any potential material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 40 years of combined cybersecurity experience across architecture, engineering, operations and compliance.


text: Our management and Board recognize the critical importance of addressing cybersecurity threats and risks to our business and operations. Therefore, we have established a comprehensive framework to assess, respond to, and manage material risks arising from cybersecurity threats.

companyName: Chatham Lodging Trust

ticker: CLDT


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by IHM, the manager of all the Company's properties, with whom we share corporate office space. IHM's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. IHM's enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. IHM's cybersecurity risk management processes include technical security controls, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. IHM has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors and other third parties who entrust us with their sensitive information.


text: IHM's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help IHM prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us. IHM's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, is integrated into IHM's information technology program. In addition, both IHM and the Company periodically engage with third-party consultants and key vendors to assist them in assessing, enhancing, implementing and monitoring its cybersecurity risk management programs and responding to incidents.


text: IHM undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of IHM's and our critical third-party vendors and other partners. IHM also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: In addition, much of the sensitive information relating to hotel guests are controlled by the respective franchisor companies, affiliates of Marriott International, Inc., Hilton Worldwide Holdings, Inc., and Hyatt Hotels Corporation, each of which is a public company with enhanced cybersecurity protection policies in place which each publicly discloses.


text: In addition, to aid its own security, the Company has adopted a number of cybersecurity policies including an Incident Response Plan, an Acceptable Use Policy for employees and a Service Provide Cybersecurity Management Policy (the "Cybersecurity Policies"), through which the Company ensures that key vendors with access to sensitive information have contractual terms obligating their compliance with the Company processes, policies and procedures.


text: IHM, in coordination with the General Counsel, is responsible for testing the Incident Response Plan on a periodic basis. In addition, the Audit Committee and the General Counsel will review on at least an annual basis the Incident Response Plan and update the Incident Response Plan, as appropriate, to address applicable legal requirements and the Company's policies, procedures and information security and business objectives. Periodically, the Audit Committee will review (i) the Cybersecurity Policies and (ii) the Company's cybersecurity risk exposure and discusses steps management has taken to monitor or mitigate such risk exposure.


text: Material Impact of Cybersecurity Risks In the last three fiscal years, we have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors— Cybersecurity failures and data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential, personal or other sensitive information and/or damage to our business relationships or reputation, any of which could negatively impact our business, financial condition and operating results."


text: Governance of Cybersecurity Risks The Audit Committee of the Board has the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. IHM and the Company's Chief Executive Officer, Chief Financial Officer, Chief Operating Officer and General Counsel (the "Executive Leadership Team") are responsible for assessing and managing cybersecurity risks. Certain members of IHM periodically report to the Company's management on cybersecurity issues and management presents information to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters.


text: Upon verifying that a cybersecurity incident has occurred or is occurring, the Executive Leadership Team or their designees, in cooperation with IHM, will promptly conduct a preliminary assessment of the severity level of the cybersecurity incident. Following this assessment, IHM will report the cybersecurity incident to the Chief Executive Officer, who in consultation with the General Counsel, will inform the chair of the Audit Committee, who will then report such cybersecurity incident to the Board as the chair deems appropriate. All Level 1 (High Severity) cybersecurity incidents will be reported to the Board.


text: In addition, much of the sensitive information relating to hotel guests is controlled by the respective franchisor companies, affiliates of Marriott International, Inc., Hilton Worldwide Holdings, Inc., and Hyatt Hotels Corporation, each of which is a public company with cybersecurity protection policies in place which each publicly discloses.


text: In addition, to aid its own security, the Company has adopted a number of cybersecurity policies including an Incident Response Plan, an Acceptable Use Policy for employees and a Service Provider Cybersecurity Management Policy (collectively, the "Cybersecurity Policies"), through which the Company ensures that key vendors with access to sensitive information have contractual terms obligating their compliance with the Company's processes, policies and procedures.


text: IHM, in coordination with our General Counsel, is responsible for testing the Incident Response Plan on a periodic basis. In addition, our Audit Committee and General Counsel will review on at least an annual basis the Incident Response Plan and update the Incident Response Plan, as appropriate, to address applicable legal requirements and the Company's policies, procedures and information security and business objectives. Periodically, the Audit Committee will review (i) the Cybersecurity Policies and (ii) the Company's cybersecurity risk exposure and discusses steps management has taken to monitor or mitigate such risk exposure.


text: Governance of Cybersecurity Risks The Audit Committee of the Board has the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. IHM and the Company's Chief Executive Officer, Chief Financial Officer, Chief Operating Officer and General Counsel (collectively, the "Executive Leadership Team") are responsible for assessing and managing cybersecurity risks. Certain members of IHM periodically report to the Company's management on cybersecurity issues and management presents information to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters.


text: Cyber Risk Management and Strategy We rely on information technology in our operations, and any material failures, inadequacies, interruptions, security failures, social engineering attacks or cyber-attacks could harm our business. Management of cybersecurity risks is a component of our overall risk management strategy, which is overseen by our senior management team and our board of directors. We rely on a managed IT service provider with a longstanding relationship with the Company to help manage cybersecurity risks. Our managed IT service provider conducts testing of our controls and environment, including penetration testing, to identify and remediate cybersecurity risks.

companyName: Terreno Realty Corp

ticker: TRNO


text: We have an employee education program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions. Before contracting with certain third parties, such as our local property managers, or purchasing third party technology or other solutions that involve exposure to sensitive company or tenant information, we conduct diligence on those third parties, which includes a security review. We maintain back-ups and disaster recovery plans to restore our information in the event of an incident.


text: Additionally, as a public company, we are subject to Sarbanes-Oxley Act ("SOX") requirements and must undergo independent audits of information technology general controls in support of internal control over financial reporting.


text: Related to Cybersecurity Risks Our third-party managed IT service provider reports to our Chief Financial Officer, Chief Accounting Officer, and Chief Operating Officer on cybersecurity matters, including cybersecurity risks. These senior executives are involved in management of information security procedures and periodically brief the board of directors on information security matters.


text: Our board of directors plays an important role in our risk oversight and discharges its duties both as a full board and through its committees. Our board is involved in risk oversight through its direct decision-making authority with respect to certain significant matters and review of our overall business strategy, as well as indirectly through the further oversight of management delegated to each of the board's committees. Our board of directors relies on management to bring significant matters impacting our company to its attention but has processes for receiving information regarding such matters and providing oversight.