text: Our management team, in conjunction with our third-party IT and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team, in conjunction with our strategic third-party partners, oversees our cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged for strategic cyber risk management, advisory and decision making.


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes an assessment of vendors during the selection and onboarding process, review of System and Organization Control (SOC) reports on an annual basis and a regular review of vendor contracts.

companyName: AEON Biopharma, Inc.

ticker: AEON

secItem: Item 1C


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of business. The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. For more information, see the section titled "Risk Factor— Our business and operations would suffer in the event of computer system failures, including but not limited to our information technology systems, infrastructure and data, or those of our third-party vendors, contractors or consultants failing, becoming unavailable, or suffering security breaches, losses or leakages of data and other disruptions, which could result in disruption of our services, compromise sensitive information (including personal information) related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity, data privacy and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program and cybersecurity risk exposures, and the steps taken by management to monitor and mitigate cybersecurity risks. The Committee is composed of members of our board of directors with diverse expertise, including risk management, biotechnology, chief executive officer and chief financial officer roles, and multiple public company directorships, which has prepared them to oversee our cybersecurity risks.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Financial Officer and EVP, Chief Legal Officer, internal security consultants and external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Financial Officer and EVP, Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security consultants; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats and to protect the confidentiality, integrity, and availability of our critical systems and information.


text: The underlying process and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology ("IT"), including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). We have an annual risk assessment performed by a third-party specialist of our cyber risk management program against the NIST CSF. This assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with our third-party specialists, have developed a risk mitigation plan to address such risks, and where necessary, to remediate potential vulnerabilities identified through the assessment process.


text: We maintain policies and processes over areas such as information security, IT asset lifecycle, data destruction, backup, access provisioning, and maintenance of network accounts, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with cybersecurity providers and consultants (collectively, "providers") leveraging third-party technology and expertise. These providers are a key part of our cybersecurity risk management strategy and infrastructure. These providers deliver services including systems inventory monitoring, vulnerability testing, user management including restricted access of privileged accounts, capacity monitoring, network protection and monitoring, endpoint protection, managed detection and response, remote monitoring and management, cybersecurity user awareness training, data backup management, incident response, cybersecurity strategy, and cyber risk advisory, assessment, and remediation.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of business. The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. For more information, see the section titled " Risk Factor— Our business and operations would suffer in the event of computer system failures, including but not limited to our information technology systems, infrastructure and data, or those of our third-party vendors, contractors or consultants failing, becoming unavailable, or suffering security breaches, losses or leakages of data and other disruptions, which could result in disruption of our services, compromise sensitive information (including personal information) related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business. "


text: The Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Executive Officer and EVP, Chief Legal Officer, internal security consultants and external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Executive Officer and EVP, Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security consultants; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.


text: We rely on our technology infrastructure and information systems to perform operational activities as well as to maintain the Trust's business records and financial data. Our internally developed system and processes, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies. Many threat actors are well funded.

companyName: Copper Property CTL Pass Through Trust

ticker: CPPTL


text: We have implemented controls and processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. The Trust's management, including its Principal Executive Officer and Principal Financial Officer, has direct oversight of the management of cybersecurity risks.


text: Management oversees our enterprise risk management process. Under the supervision and with the participation of our management, including our Principal Executive Officer and Principal Financial Officer, we conduct an annual comprehensive enterprise risk assessment, which includes details of our management of enterprise-wide risk topics, such as those related to cybersecurity risks. Management receives the full results of the annual enterprise risk assessment, including an evaluation of cybersecurity risks presented, a detailed description of the actions we have taken to mitigate these risks and an analysis of cybersecurity threats and incidents across the industry. Management reviews the results of the enterprise risk assessment in detail on a regular basis.


text: We have adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation and periodic assessments of third-party service providers to assess cyber preparedness of key vendors.


text: We are not aware of any risks from cybersecurity threats, including any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the Trust, including its business, results of operations or financial condition. Refer to Item 1A. Risk Factors in this Annual Report on Form 10-K, specifically "Information technology, data security breaches and other similar events could harm the Trust," for additional discussion about cybersecurity-related risks.


text: As an externally managed trust, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Manager. While w e rely on our Manager's and our Manager's parent company's technology infrastructure and information systems to perform operational activities as well as to maintain the Trust's business records and financial data, we do not possess sensitive personal data for any third parties or employees. The Trust's business is highly dependent on the communications and information systems of the Manager, its affiliates and third-party service providers or employees. The Manager has adopted processes designed to identify, assess and manage material risks from cybersecurity threats to the Trust. These processes include assessments of internal and external threats to the confidentiality, integrity and availability of the Trust's data and systems along with other material risks to its operations. These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting, and responding to threats.


text: Management, including our Principal Executive Officer and Principal Financial Officer, oversees our enterprise risk management process in collaboration with our Manager and our Manager's parent company. Our Principal Executive Officer and Principal Financial Officer bring over 17 and 20 years of experience, respectively, in overseeing IT infrastructure management as part of their executive and audit committee roles across various companies. Additionally, both have completed cybersecurity training to enhance their expertise in risk management and IT security.


text: No less frequently than annually, the Manager completes an assessment to identify potential cybersecurity threats and vulnerabilities and to better prioritize and mitigate the Trust's cybersecurity risk. The Manager maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of the Trust's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. The Manager provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate the Manager's evolving information security policies, standards, processes and practices.


text: We maintain a comprehensive Information Security Management System ("ISMS") program, which is led by a dedicated Chief Information Security Officer ("CISO"), who joined the Company in April 2023 and has 25 years of extensive technical and SaaS experience, having served in roles of increasing responsibility relating to information security at other large public companies. Our CISO has undertaken a comprehensive review of our information security systems and processes, and as a result, we have made significant improvements to our cybersecurity controls and procedures over the last eight months, and expect to see additional incremental improvement in our cybersecurity risk management over the next six to twelve months.

companyName: Vimeo, Inc.


text: Under the CISO, the Information Security Team is responsible for defining and implementing the Company's cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Team oversees the delivery of network, cloud, email and application security, security monitoring, penetration testing, cybersecurity training and incident response. Our ISMS program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards and Technology. Through our ISMS program, we have established a comprehensive collection of policies and standard operating procedures to guide our cybersecurity strategy, which includes an Information Security Policy applicable to all Vimeo personnel, as well as a Supplier Information Security Policy for our third-party software vendors, both of which set forth cybersecurity standards, controls, and training requirements designed to protect corporate and customer data, whether it is processed by Vimeo or a service provider. We also conduct regular workforce training to instruct employees to identify cybersecurity concerns and take the appropriate action.


text: Our cybersecurity governance framework includes oversight by the Audit Committee of our Board of Directors, which reviews the effectiveness of the Company's management of cybersecurity, data privacy and other data- and technology-related risks, controls and procedures. The CISO reports regularly to our Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our ISMS program is regularly evaluated by external experts with the results of those reviews reported to senior management and the Board. The Audit Committee, and as appropriate, the Board, also receives prompt and timely information regarding any high severity cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed.


text: As of the date of this report, we are not aware of any material risks resulting from any previously reported cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. We discuss the risks relating to cybersecurity threats and their potential impact on our business more fully in "Risk Factors" in Part I, Item 1A herein. Continuously enhancing our information security controls to meet the evolving cybersecurity threat landscape remains a top priority.


text: We maintain a comprehensive Information Security Management System ("ISMS") program, which is led by a dedicated Chief Information Security Officer ("CISO"), who joined the Company in October 2024 and has almost 20 years of experience in enterprise grade cybersecurity and global scale systems, having previously served as a CISO of another public company and as a cybersecurity consultant. Our CISO is undertaking a comprehensive review of our information security systems and processes, and as a result, we may make incremental improvements to our cybersecurity controls and procedures and our cybersecurity risk management over the next six to twelve months.


text: Under the CISO, the Information Security Team is responsible for defining and implementing the Company's cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Team oversees the delivery of network, cloud, email and application security, security monitoring, penetration testing, cybersecurity training and incident response. Our ISMS program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not directly or fully comply with all elements of these standards. Through our ISMS program, we have established a comprehensive collection of policies and standard operating procedures to guide our cybersecurity strategy, which includes an Information Security Policy applicable to all Vimeo personnel, as well as a Supplier Information Security Policy for our third-party software vendors, both of which set forth cybersecurity standards, controls, and training requirements designed to protect corporate and customer data, whether it is processed by Vimeo or a service provider. We also conduct regular workforce training to instruct employees to identify cybersecurity concerns and take the appropriate action.


text: Our cybersecurity governance framework includes oversight by the Audit Committee of the Board, which reviews the effectiveness of the Company's management of cybersecurity, data privacy and other data- and technology-related risks, controls and procedures. The CISO reports regularly to our Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our ISMS program is regularly evaluated by external experts with the results of those reviews reported to senior management and the Board. The Audit Committee and, as appropriate, the Board, also receives prompt and timely information regarding any high severity cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed.


text: As of the date of this report, we are not aware of any material risks resulting from any previously reported cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. We discuss the risks relating to cybersecurity threats and their potential impact on our business more fully in "Risk Factors" in Part I, Item 1A herein.


text: Assessment, Identification and Management of Material Risks from Cybersecurity The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy and policies implemented by the Adviser and HPS, the providers of our technology services. The Adviser manages the Company's day-to-day operations and has implemented, together with HPS, a firm-wide cybersecurity program that applies to the Company and its operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by HPS, and (ii) any actions of the Adviser shall be deemed to refer to actions of HPS and/or the Adviser, as the context may require.

companyName: HPS Corporate Lending Fund


text: The Adviser's cybersecurity program prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact the Company. The Adviser's cybersecurity program is aligned to the Center for Internet Security critical controls framework. The Adviser's cybersecurity risk management processes applicable to the Company include technical security controls, policy enforcement mechanisms, monitoring systems, and other tools. Third-party providers are leveraged to assist in assessing, identifying and managing risks from cybersecurity threats applicable to the Company. The assessment of cybersecurity risks, including those which may be applicable to the Company, is integrated into the Adviser's overall risk management program. The Adviser has implemented and continues to implement risk-based controls designed to prevent, detect, and respond to information security threats and the Company relies on such controls.


text: The Adviser's cybersecurity program includes physical, administrative, and technical safeguards, as well as plans and procedures designed to help the Company prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact the Company. The Adviser's cybersecurity risk management processes seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat, and mitigate such threats. The Company relies on the Adviser to engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity program and risk management processes and responding to incidents.


text: The Adviser's 's cybersecurity risk management and awareness programs, which apply to the Company, include identification and testing of vulnerabilities, phishing simulations and cybersecurity awareness training. The Adviser undertakes internal security reviews of its information systems and related controls, including those applicable to the Company. The Adviser also completes external reviews of the cybersecurity program and practices applicable to the Company, which may include assessments of relevant data protection practices and targeted attack simulations.


text: The Adviser has developed an incident response plan that provides guidelines for responding to cybersecurity incidents. The incident response plan includes notification to the applicable members of cybersecurity leadership, including the Adviser's Chief Information Security Officer ("CISO"), and, as appropriate, escalation to other relevant individuals. Incidents may also be reported to the audit committee or full board of directors of the Adviser, as well as to the Audit Committee, if appropriate.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with the Adviser's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: Management's Role in Cybersecurity Risk Oversight The Adviser's CISO and dedicated internal cybersecurity team are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes). The Company's Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the board about the Adviser's compliance with its responsibilities for the Adviser's and the Company's cybersecurity program. The Adviser's CISO has 10 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Adviser's CISO works closely with Company management to administrator, assess, discuss, and prioritize the Company's cybersecurity efforts. The Company's CCO has been responsible for this monitoring and reporting as CCO to the Company for 3 years and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.


text: Board Oversight of Cybersecurity Risks The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. Certain members of the Company update the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by the Company's CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to the Company, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on the Company's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy and policies implemented by the Adviser and HPS, the providers of our technology services. The Adviser manages our day-to-day operations and has implemented, together with HPS, a firm-wide cybersecurity program that applies to us and our operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by HPS, and (ii) any actions of the Adviser shall be deemed to refer to actions of HPS and/or the Adviser, as the context may require.


text: The Adviser's cybersecurity program prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact us. The Adviser's cybersecurity program is aligned to the Center for Internet Security critical controls framework. The Adviser's cybersecurity risk management processes applicable to us include technical security controls, policy enforcement mechanisms, monitoring systems, and other tools. Third-party providers are leveraged to assist in assessing, identifying and managing risks from cybersecurity threats applicable to us. The assessment of cybersecurity risks, including those which may be applicable to us, is integrated into the Adviser's overall risk management program. The Adviser has implemented and continues to implement risk-based controls designed to prevent, detect, and respond to information security threats and we rely on such controls.


text: The Adviser's cybersecurity program includes physical, administrative, and technical safeguards, as well as plans and procedures designed to help us prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact us. The Adviser's cybersecurity risk management processes seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat, and mitigate such threats. We rely on the Adviser to engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity program and risk management processes and responding to incidents.


text: The Adviser's cybersecurity risk management and awareness programs, which apply to us, include identification and testing of vulnerabilities, phishing simulations and cybersecurity awareness training. The Adviser undertakes internal security reviews of its information systems and related controls, including those applicable to us. The Adviser also completes external reviews of the cybersecurity program and practices applicable to us, which may include assessments of relevant data protection practices and targeted attack simulations.


text: Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with the Adviser's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate our business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or that are reasonably likely to materially affect us, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: Management's Role in Cybersecurity Risk Oversight The Adviser's CISO and dedicated internal cybersecurity team are responsible for the cybersecurity program applicable to us (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes). Our Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the board about the Adviser's compliance with its responsibilities for the Adviser's and our cybersecurity program. The Adviser's CISO has over 15 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures in both US Government Intelligence agencies and Financial Services firms. The Adviser's CISO reports to the Chief Financial Officer of the Adviser and works closely with our management to administer, assess, discuss, and prioritize our cybersecurity efforts. Our CCO has been responsible for this monitoring and reporting as CCO to us for 3 years and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risks applicable to us.


text: Board Oversight of Cybersecurity Risks The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. Certain of our members update the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by our CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to us, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information and maintaining operational resilience. We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems.

companyName: Brand Engagement Network Inc.

ticker: BNAI


text: The Audit Committee of the Board of Directors (the "Audit Committee") is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Our management is responsible for the day-to-day oversight and management of our enterprise risks, including risks from cybersecurity threats. Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Chief Information and Data Officer and dedicated information security team, who develop, prioritize, and execute our cybersecurity strategy in partnership with relevant departments and business units. Our CIDO, who has over 25 years of information technology experience including cybersecurity and information security, oversees our cybersecurity framework and reports to our management-level information technology steering subcommittee and management-level enterprise risk management committee. Our CIDO is assisted in this oversight role by additional members of management.


text: The Company's data security framework integrates technical solutions, policies, controls, data governance, and employee training. Key components of our framework include strong encryption, access control, regular updates, data backup, and endpoint security. The Company is also currently implementing features within its AWS environment, such as Security Hub, and is committed to compliance with HIPAA and SOC 2. The Company continuously researches alternatives to its current framework, recognizing that cybersecurity presents an ever-evolving challenge.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. To date, we have not experienced any cyber incidents that have had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors - Risks Related to Our Business and Industry – If our information technology systems or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: To help address cybersecurity threats, we have developed a strategy and implemented a program to identify, assess, and prioritize cybersecurity risks as part of our broader ERM program. We are committed to a risk-centric, layered information security approach to secure our data, systems, and services. We prioritize our data security initiatives and processes based on our assessment of known and anticipated threats to our data security. Utilizing the National Institute of Standards and Technology (NIST) Cybersecurity Framework, we strive for continuous improvement and utilize a metrics-based approach to identify and mitigate data security risks that could potentially impact our business operations or clients.

companyName: H&R BLOCK INC

ticker: HRB


text: We maintain multiple levels of protection to mitigate data security risks, and we regularly test our systems to discover and address potential vulnerabilities, including without limitation: • using a multi-layered, zero-trust principled approach to secure systems; • systematic monitoring of our sites and services to detect and respond to unauthorized activity; and • regular security audits and vulnerability assessments conducted by our dedicated internal information security team, our internal auditors, and by external third parties.


text: In addition, we engage in a broad range of activities to secure and protect the data that we obtain through our business operations including, but not limited to: • continued development and enhancement of our controls, processes, and practices designed to protect our systems, computers, software, data, and networks from attack, damage, or unauthorized access; • security and business controls to appropriately limit access to and use of personal information, including adaptive and multifactor authentication; • comprehensive data protections, including encryption, to facilitate the secure storage, use, and transmission of sensitive data; • annual privacy/data security training to all employees and contractors and regular awareness and testing activities year-round regarding social engineering threats, such as phishing, for employees; • background checks on our employees, as permitted; • due diligence requirements and controls for third parties (e.g., service providers) with access to sensitive data throughout the lifecycle of the relationship; and • a dedicated global information security team that partners with all technology groups to monitor, prioritize, and remediate risks to the enterprise.


text: The Audit Committee of the Board of Directors has the primary responsibility of assisting our Board in the oversight of policies and processes pertaining to the ERM program and specifically considers risks and controls relating to, among other things, data and cybersecurity. Risks associated with cybersecurity threats are a top priority for ongoing oversight by the ERM team and the Enterprise Risk Committee. Our Chief Risk Officer oversees the activities of the Enterprise Risk Committee and, together with the Chief Information Security Officer (CISO), briefs the Audit Committee and the Board of Directors on information security risk matters as a part of regular ERM reports, with a deep dive focused on information security at least annually (or more frequently if appropriate).


text: In addition, the Audit Committee receives regular reports on cybersecurity matters from the Chief Information Officer (CIO) and the CISO. The Board of Directors is also updated by the CIO and CISO on a periodic basis. Our CIO, who reports directly to the President and CEO, has over 30 years of leadership experience in technology-based roles across multiple industries. Our CISO, who reports directly to the CIO, has extensive cybersecurity knowledge and skills gained from over 25 years of information technology experience, with more than 15 years of Information Security specialization. Our CISO is responsible for understanding, managing, and communicating cybersecurity risks internally to our management (including the Enterprise Risk Committee on which he serves), and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements.


text: Our CISO heads the Information Security team, which is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business. The Information Security team covers a wide range of cyber and information security responsibilities. Our CISO also receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by us to identify and mitigate cybersecurity risks. In addition to our internal capabilities, we also periodically engage external consultants, legal counsel, or other third-party advisors to assist with assessing, identifying, and managing cybersecurity risks.


text: Material Cybersecurity Risks, Threats, and Incidents We have been, and continue to be, the subject of cybersecurity threats, and we describe how risks from these threats, if realized, are reasonably likely to materially affect us. See further discussion of these items in our Item 1A. Risk Factors of this Form 10-K. As of the date of this report, we have not identified risks from any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. However, there can be no assurance that cybersecurity threats will not have a material impact on us, including our business strategy, results of operations, or financial condition, in the future.


text: Organizations in our industry are frequently confronted with a broad range of cybersecurity threats, ranging from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology ("IT") environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises. Although we employ comprehensive measures to prevent, detect, address, and mitigate these threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personal identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include remediation and restoration costs, reputational damage, litigation with third parties, and diminution in the value of our investment in research and development, which in turn could adversely affect our competitiveness and results of operations. Accordingly, cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach.

companyName: Janus International Group, Inc.

ticker: JBI


text: The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. The Company has established certain controls and procedures, including an Incident Response Plan, that provide for the identification, analysis, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In particular, the Company's Incident Response Plan: (i) is designed to identify and detect information security threats through various mechanisms, such as through security controls and third-party disclosures; and (ii) sets forth a process to (a) analyze any such threats detected within the Company's IT environment or within a third-party's IT environment, (b) contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity incidents to a normal state of business operations. The Company has established and maintains other incident response and recovery plans that address the Company's response to a cybersecurity incident.


text: We have cybersecurity insurance (subject to specified retentions or deductibles) related to cybersecurity incidents that addresses costs, losses, and expenses related to cybersecurity investigations, crisis management, notification processes and credit monitoring services, public relations, and legal advice. Additionally, this cybersecurity insurance may cover certain physical injury to, loss or destruction of tangible property, including loss of use thereof, or loss of use of tangible property which has not been physically injured or destroyed. However, damages, fines, and claims arising from such incidents may not be covered or may exceed the amount of any insurance available or may not be insurable.


text: As part of its cybersecurity program, the Company deploys comprehensive measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, intrusion prevention and detection systems, identity and access controls, software patching protocols, physical security measures, multi-factor authentication, and other tools to detect data exfiltration. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents by assessing current threat intelligence from various sources, including but not limited to, certain key vendors, the United States Cybersecurity & Infrastructure Security Agency ("CISA"), and the open source threat intelligence community via open-source threat intelligence databases. Furthermore, we conduct periodic table top exercises, vulnerability and security testing, and "lessons learned" reviews from internal and industry related cybersecurity incidents. We have a process to report material results of such testing and assessments to the Board and our Audit Committee, and periodically make adjustments to our cybersecurity program based on these exercises and reviews. The Company engages third parties to conduct certain aspects of such testing and to assist with the Managed Detection and Response ("MDR") of security events as well as the collection and reporting of data for cybersecurity key performance indicators (i.e., KPIs). The Company seeks to identify and oversee cybersecurity risks presented by third parties and their systems from a risk-based perspective through a vendor management program, including annual reviews of key vendors' adherence to cybersecurity compliance, the monitoring of alerts from CISA, as well as open-source threat intelligence.


text: Some of our IT systems and products operate within a hosted architecture or by third-party service providers, and if these third-party IT environments fail to operate properly, our systems and products (including our Nok Smart Entry System) could stop functioning for a period of time, which could put our users at risk. Accordingly, our ability to keep our business operating is highly dependent on the proper and efficient operation of IT service providers, and our vendor management process is an important part of our risk mitigation strategy. In particular, we review Service Organization Controls ("SOC") reports describing vendors' compliance with cybersecurity best practices when they are available or an appropriate subset of those controls for vendors who do not have a SOC report. Notwithstanding, if there is a catastrophic event, such as an adverse weather condition, natural disaster, terrorist attack, security breach, or other extraordinary event, we, and our service providers, may be unable to provide our services and products for the duration of the event and/or a time thereafter.


text: In light of the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives, and requests management to report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks. Both the Audit Committee (on no less than a quarterly basis) and the full Board (on no less than an annual basis) receive regular reports from our Information Technology Department on cybersecurity risks, timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. We anticipate these reporting activities will be overseen by our newly appointed Chief Information Officer ("CIO") moving forward.


text: The Company's information security and cybersecurity program is managed by a dedicated CIO, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO provides periodic reports to our Board and Audit Committee as well as our Chief Financial Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the information security program, and the emerging threat landscape. Specifically, our management-driven ERM Committee and Incident Response team include executives from key departments across the Company and each work collaboratively to ensure periodic reviews and assessments of the Company's security environment are being observed.


text: In November 2023, the Company appointed its first CIO, Phil Stevens, who served as both a CIO and Chief Technology Officer in previous roles, prior to joining the Company. Mr. Stevens has more than 25 years of experience in privately held and publicly traded companies and has an established track record of developing and overseeing various cybersecurity programs. Mr. Stevens holds a Bachelor of Science (B.S.) in Computer Science from Purdue University, a Master of Science (M.S.) in Information Technology from the Florida Institute of Technology, and specializations in AI Product Management and Machine Learning Operations (MLOps) from Duke University (Online).


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Protocols and Strategy Organizations in our industry are frequently confronted with a broad range of cybersecurity threats, ranging from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology ("IT") environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises. Although we employ comprehensive measures to prevent, detect, address, and mitigate these threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personal identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include remediation and restoration costs, reputational damage, regulatory fines, litigation with third parties, and diminution in the value of our investment in research and development, which in turn could adversely affect our competitiveness and results of operations. Accordingly, cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach.


text: All new hires are required to complete mandatory cybersecurity awareness training upon joining the Company. Follow-on training is then assigned to all employees on a regular basis. Training assignments reinforce the Company's security and information technology acceptable use policies, while also helping employees identify and properly respond to cybersecurity threats. To help assess and maintain awareness, training is supplemented with simulated phishing e-mails that are sent on a regular basis.


text: In light of the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives, and requests that management to report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks. Both the Audit Committee (on no less than a quarterly basis) and the full Board (on no less than an annual basis) receive regular reports from our Chief Information Officer ("CIO") on cybersecurity risks, timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Company's information security and cybersecurity program is managed by a dedicated CIO, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our CIO has more than 25 years of experience in privately held and publicly traded companies and has an established track record of developing and overseeing cybersecurity programs. Additionally, our CIO holds a Bachelor of Science in Computer Science, a Master of Science in Information Technology, and specializations in AI Product Management and Machine Learning Operations. Our CIO provides periodic reports to our Board and Audit Committee as well as our Chief Financial Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the information security program, and the emerging threat landscape. Specifically, our management-driven ERM Committee and Incident Response team include executives from key departments across the Company and each work collaboratively to ensure periodic reviews and assessments of the Company's security environment are being observed.


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: As of the date of this Annual Report, we believe that we have limited risks associated with a breach in cybersecurity. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (of which we are not aware of any), have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. management and strategy.

companyName: Texas Mineral Resources Corp.

ticker: TMRC


text: We have not established specific processes for assessing, identifying, and managing material risks from cybersecurity threats or engaged third parties to assess such risks. However, if exposed to such a risk, we would assess any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.


text: While we lack a formal risk assessment policy or analysis and no process has been integrated into our management system, a risk assessment would likely include identification of any reasonably foreseeable internal and external risks, any likelihood and potential damage that could result from such risks, and whether existing safeguards are sufficient to manage such risks. If appropriate and necessary, we would implement reasonable safeguards to minimize identified risks and address any identified gaps in existing systems.


text: Primary responsibility for assessing any cybersecurity risks rests with our chief financial officer, who would report any threat to our board of directors.


text: To date, we have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition..


text: As a community bank, we rely heavily on information technology and telecommunications systems to conduct our business activities, such as processing transactions, maintaining records, communicating with customers and vendors, and providing online and mobile banking services. These systems are subject to various cybersecurity threats, such as unauthorized access, hacking, phishing, malware, ransomware, denial-of-service attacks, and other malicious or criminal activities, that could compromise the confidentiality, integrity, or availability of our systems, data, or customer information. Cybersecurity threats may originate from external sources, such as cybercriminals, hackers, terrorists, or foreign governments, or from internal sources, such as employees, contractors, or vendors. Cybersecurity threats may also target our third-party service providers, such as core processors, cloud providers, or payment processors, whose systems and data are interconnected with ours.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: We have implemented various security measures and controls to protect our systems and data from unauthorized access, use, or disclosure, such as firewalls, encryption, authentication, backup, and recovery, both internally and with our third party managed service provider. We also have established policies and procedures to monitor and respond to cybersecurity incidents, and to comply with applicable laws and regulations regarding cybersecurity and data privacy. We regularly review and update our security measures and controls to address the evolving nature and sophistication of cybersecurity threats. We also provide training and education to our employees and customers on cybersecurity awareness and best practices. In addition, we maintain cyber liability insurance coverage to mitigate the potential financial impact of cybersecurity incidents. Furthermore, internal and external auditors and regulators periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain a Business Continuity and Incident Response Program that provides a documented framework for responding to actual or potential incidents, including engagement of appropriate third parties such as insurance providers and incident response professionals, and timely reporting to our chief executive officer and board of directors as appropriate.


text: The Business Continuity and Incident Response Program is coordinated by the information security officer and key members of management are embedded into the Plan by its design. The Business Continuity and Incident Response Program facilitates coordination across multiple areas of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is always present. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. Despite our efforts, we cannot guarantee that our security measures and controls will be sufficient or effective to prevent, detect, or mitigate all cybersecurity incidents or to protect our systems and data from unauthorized access, use, or disclosure. We may experience cybersecurity incidents in the future that could result in operational disruption, reputational damage, customer dissatisfaction, loss of business or revenue, legal liability, regulatory actions, fines, penalties, or remediation costs.


text: Any of these outcomes could have a material adverse effect on our business, operations, and financial condition. While we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected the Corporation to date.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risks; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage any material risks.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk management process. As part of our overall risk management process, our Vice President of Internal Audit collaborates with subject matter specialists throughout the Company, as necessary, to gather insights for identifying and assessing material risks throughout the Company, including cybersecurity threat risks.


text: In addition, we have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. We also have business processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents.


text: Our Cybersecurity Incident Response Plan ("IRP") coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to detect, analyze, validate, investigate contain, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our processes also address cybersecurity threat risks associated with third-party service providers that may have access to our data or systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations may affect the selection and oversight of our third-party service providers.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. The Audit Committee of our Board is responsible for the oversight of risks from cybersecurity threats. The Audit Committee regularly receives an overview from management of our cybersecurity activities. Material cybersecurity threat risks may also be considered during separate Board discussions of important matters such as enterprise risk management, budgeting, and other relevant matters.


text: Our processes around cybersecurity risk management and strategy are led by our Chief Information Officer ("CIO"), who reports directly to our Chief Executive Officer. Our CIO meets with the Audit Committee of our Board as part of the governance process described above. This individual has prior work experience in various roles involving managing information security and risk management, developing cybersecurity strategy, and implementing cybersecurity programs. The IT subject matter experts meet quarterly to review the cybersecurity framework provided by National Institute of Standards and Technology and evaluate current cybersecurity processes and procedures.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws, other litigation and legal risks, and reputational risks. To aid in our efforts to assess, identify, and manage any material risks, we have implemented several cybersecurity processes, technologies, and controls.


text: Our process for identifying and assessing material risks from cybersecurity threats operates within our broader overall risk management program. As part of this program, our Chief Information Officer ("CIO") and Vice President of Internal Audit collaborate with subject matter specialists throughout the Company, as necessary, to gather insights for identifying and assessing material risks throughout the Company, including cybersecurity threat risks.


text: In addition, we also have business processes to provide for critical data and systems availability, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents.


text: Our Cybersecurity Incident Response Plan ("IRP") coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to detect, analyze, validate, investigate, contain, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our processes also address cybersecurity threat risks associated with third-party service providers that may have access to our data or systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations may affect the selection and oversight of our third-party service providers.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. The Audit Committee of our Board is responsible for the oversight of risks from cybersecurity threats. The Audit Committee regularly receives an overview of our cybersecurity activities from management. Material cybersecurity threat risks may also be considered during separate Board discussions of important matters such as enterprise risk management, budgeting, and other relevant matters.


text: Our cybersecurity risk management and strategy processes are led by our CIO, who reports directly to our President and Chief Financial Officer. Our CIO meets with the Audit Committee of our Board as part of the governance process described above. This individual has prior work experience in various roles involving managing information security and risk management, developing cybersecurity strategies, and implementing cybersecurity programs. The IT subject matter experts meet quarterly to review the cybersecurity framework provided by the National Institute of Standards and Technology and evaluate current cybersecurity processes and procedures.


text: SoundHound acknowledges the increasing importance of cybersecurity in its operations and recognizes the potential risks and threats associated with cyber incidents. The Company is committed to maintaining the confidentiality, integrity, and availability of its information systems and data. However, no system can be completely immune to cyber threats. We face a number of cybersecurity risks in connection with our business. To date, such risks have not materially affected our business, including threats to and breaches of our data systems, malware and computer virus attacks.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: The following information provides an overview of our approach to managing cybersecurity risks. The Company assesses, identifies and manages cybersecurity related risks. Cybersecurity related risks are evaluated to assess top risks to the enterprise on a bi-annual basis. SoundHound has implemented a comprehensive cybersecurity program designed to identify, assess, and manage cyber risks.


text: This program includes, but is not limited to: • Regular risk assessments and vulnerability assessments. • Implementation of industry-accepted cybersecurity controls and best practices. • Employee training and awareness programs to enhance the company's overall cybersecurity posture. • Continuous monitoring and incident response plans to detect and mitigate potential threats promptly.


text: We have a set of Company-wide policies and procedures concerning cybersecurity matters, such as policies related to encryption standards, antivirus protection, remote access, multi factor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an annual internal review process and are approved by appropriate members of management.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level and by reviewing our operational policies and procedures. We review our operational policies and procedures with third party experts on an annual basis as part of our annual audit process. We also maintain cyber insurance coverage. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Vendor Management Team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: SoundHound will report any cybersecurity incidents determined to be material. Material aspects of the nature, scope and timing of the incident, and the impact or reasonably likely impact of the incident on the Company, including on SoundHound's financial condition and results of operations will be disclosed.


text: The audit committee oversees risks from cybersecurity threats as part of its broader risk oversight responsibilities. The board recognizes the importance of cybersecurity in safeguarding the company's assets and operations.


text: SoundHound has a dedicated Information Security Management committee responsible for overseeing risks from cybersecurity threats. The committee's charter outlines its specific responsibilities related to cybersecurity risk oversight, and assists senior management in fulfilling its oversight responsibilities by creating, implementing, overseeing and maintaining SoundHound's Information Security Management System. The purpose of the ISMS is to protect the Company's information systems and assets, taking into account the potential for external threats, internal threats, and threats arising from transactions with trusted third parties and vendors. The board of directors is informed of cybersecurity risks, at least annually, through established processes, including periodic briefings, reports, and updates on the evolving landscape of cybersecurity threats.


text: SoundHound designates the Information Security Management Committee as responsible for assessing and managing cybersecurity risks. Committee members possess professional experience or backgrounds presenting relevant experience or capacity to address those matters within the scope of the Committee's responsibility, including senior executives, department leaders, and subject matter experts. Committee members are familiar, or have the ability to quickly gain familiarity, with major technology platforms employed by the Company; have knowledge of technological ecosystems and challenges confronted in current or emerging business environments; have the capacity to understand new or emerging technologies and cyber security threats; are familiar, or have the ability to quickly gain familiarity, with information security principles, privacy regulations, standards, and guidelines; and possess experience relating to enterprise risk management and process.


text: We view cybersecurity as a shared responsibility. All employees are required to complete cybersecurity training as part of onboarding, on an annual basis and have access to more frequent cybersecurity training online. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training. The designated persons or committees actively monitor cybersecurity incidents through processes that monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, including continuous assessment and adaptation to emerging threats.


text: To identify and manage the material risks of cybersecurity threats to our business, operations and control environments, we have made investments in our technology and have implemented policies, programs and controls, with a focus on cybersecurity incident prevention and mitigation. Our cybersecurity program is integrated into our risk management process and is managed by a dedicated cybersecurity team that is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology Cybersecurity Framework. As part of our cybersecurity process, we engage external experts and consultants to assess our cybersecurity program and compliance with applicable practices and standards.

companyName: DT Midstream, Inc.

ticker: DTM


text: The Company mitigates risks from cybersecurity incidents using a multifaceted approach which includes, but is not limited to: establishing information security policies, implementing information protection processes and technologies, assessing cybersecurity risk, implementing cybersecurity training, monitoring our information technology systems, and collaborating with public and private organizations on best practices. The Company is currently in material compliance with relevant information privacy and cybersecurity governmental standards with which it is required to comply.


text: The Company has not experienced a material cybersecurity incident during the year ended December 31, 2023. For more information on how material cybersecurity incidents may impact our business, see Part I, Item 1A. "Risk Factors— Other Business Risks—"A cyberattack or threat could harm our business" of this Form 10-K.


text: On July 26, 2023, the SEC adopted a final rule requiring, among other things, registrants to disclose certain information regarding cybersecurity risk management, strategy and governance annually and certain information about material cybersecurity incidents within four business days of the incident. The final rule became effective on September 5, 2023.


text: The Director of Cybersecurity has over 20 years of relevant experience and is responsible for managing our cybersecurity program and team, which monitors the day-to-day risks using the approach described above. Material near-term and long-term risks are communicated with senior management and the Board of Directors. The Company's Board of Directors is engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and exposures. While the Board of Directors retains oversight over policy and strategy related to cybersecurity, it has delegated the responsibility for the oversight of the Company's cybersecurity program to the Audit Committee. The Audit Committee is responsible for reviewing and discussing the Company's policies regarding risk assessment and risk management, major accounting risk exposures and the implementation and effectiveness of risk management protocols with respect to information technology security and cybersecurity risks, as well as reviewing material breaches and attacks, as applicable.


text: The Company mitigates risks from cybersecurity incidents using a multifaceted approach which includes but is not limited to: establishing information security policies, implementing information protection processes and technologies, assessing cybersecurity risk, implementing cybersecurity training, monitoring our information technology systems, and collaborating with public and private organizations on best practices. The Company is currently in material compliance with relevant information privacy and cybersecurity governmental standards with which it is required to comply.


text: The Company has not experienced a material cybersecurity incident during the year ended December 31, 2024. For more information on how material cybersecurity incidents may impact our business, see Part I, Item 1A. "Risk Factors—Risks Relating to Our Business—Other Business Risks—A cyberattack or threat could harm our business" of this Form 10-K.


text: Our Director of Cybersecurity has over 20 years of relevant experience and is responsible for managing our cybersecurity program and team, which monitors the day-to-day risks using the approach described above. Material near-term and long-term risks are communicated with senior management and the Board of Directors. The Company's Board of Directors is engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and exposures. While the Board of Directors retains oversight over policy and strategy related to cybersecurity, it has delegated the responsibility for the oversight of the Company's cybersecurity program to the Audit Committee. The Audit Committee is responsible for reviewing and discussing the Company's policies regarding risk assessment and risk management, major accounting risk exposures and the implementation and effectiveness of risk management protocols with respect to information technology security and cybersecurity risks, as well as reviewing material breaches and attacks, as applicable.


text: We rely on information technology and data to operate our business and develop, market, and deliver our products and services to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, software, and our confidential, personal, proprietary, and sensitive data (collectively, "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats. We have implemented an information technology security policy, which includes cybersecurity vulnerability management designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

companyName: OPAL Fuels Inc.

ticker: OPAL


text: We engage in processes designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools. We subscribe to reports and services that identify cybersecurity threats, analyze reports of threats and conduct vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. We work with third parties, including cybersecurity software providers and managed cybersecurity service providers, to identify and assess cybersecurity risks and conduct penetration testing.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by a third-party service provider reporting to the Company's management. Management is also responsible for integrating cybersecurity considerations into our overall risk management strategy, communicating key priorities to employees, approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and making required disclosures. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Wag! Group Co.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a Security team responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes, and to provide support during incident response efforts; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile. • There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see "Risk Factors — Risks Related to Privacy and Technology — Changes in laws, regulations, or industry standards relating to privacy, data protection, or the transfer or processing of data relating to individuals, or any actual or perceived failure by us to comply with such laws and regulations or any other obligations, including contractual obligations, relating to privacy, data protection, or the transfer or processing of data relating to individuals, could adversely affect our business, results of operations and financial condition."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives reports regularly from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer ("CTO"), internal staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CTO, is responsible for assessing and managing our material risks from cybersecurity threats. Our CTO leads a team that has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our CTO has more than 12 years of experience in cybersecurity, software, and IT in various technology-related businesses, including some oversight over security and integrity of systems and operations. In addition, our CTO leads our Security team, who have more than 16 years of experience in these fields.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; any retained external cybersecurity consultants; and alerts and reports produced by security tools deployed in the IT environment. Our management team reports information about cybersecurity risks to the Committee.


text: We maintain a comprehensive technology and cybersecurity program designed to ensure our systems are effective and prepared for information security risks. This includes regular oversight of our programs for security monitoring for internal and external threats to maintain the confidentiality and integrity of our information assets. We have a formal, risk-based and enterprise-wide risk assessment program, which incorporates the assessment of security risk exposures, including cybersecurity risks.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: Security starts for our system at the edge of the network. We then build security deeper into the system resulting in interlocking layers designed to strengthen each other. Our information security management system is based upon industry leading frameworks, including ISO 27001. ISO 27001 specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented Information Security Management System within the context of the organization's overall business risks. It specifies the requirements for the implementation of security controls customized to the needs of individual organizations and addresses confidentiality, access control, vulnerability, business continuity, and risk assessment.


text: In addition, our cybersecurity program includes the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect these information assets. We have implemented security monitoring capabilities designed to alert us to suspicious activity and developed an incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a breach. Our information security team conducts annual information security awareness training for employees involved in our systems and processes that handle customer data and enhanced training for specialized personnel. Additionally, our information security team conducts internal annual audits of our systems.


text: Our program includes annual review and assessment by external, independent third-parties, who evaluate and report on our internal incident response preparedness, adherence to best practices and industry frameworks, compliance with applicable laws and regulations, and help with identifying areas for continued focus and improvement. We perform penetration tests and an independent audit every quarter to ensure our systems are secure. We also carry general liability insurance coverage and coverage for errors and omissions that is expected to provide protection against certain potential losses arising from a cybersecurity incident. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.


text: Policies and processes are also in place to ensure review and identification of risks from cybersecurity threats associated with third-party service providers and vendors. Cybersecurity reviews are required prior to initiating any engagements with third-party service providers and vendors who receive access to IAS systems and infrastructure. Additionally, recurring annual audits of such critical third-party service providers and vendors are completed by our Information Security team.


text: Certain of our data processing equipment is housed in third-party commercial data centers or on servers owned and operated by cloud-based service providers. We generally enter into service level agreements with these parties that include provisions for the implementation and operation of effective security controls at the third-party organizations. We have experienced, and may in the future experience, whether directly or through our third party providers, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations, and financial condition. For additional information about our cybersecurity risks, please refer to "Risks Related to Intellectual Property and Technology" in Item 1A, "Risk Factors."


text: The Board of Directors oversees the Company's information security program that institutes and maintains controls for the systems, applications, and databases of the Company and of its third-party providers and has delegated primary oversight of cybersecurity risks to the Audit Committee, which monitors the steps our management has taken to monitor and control exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken.


text: Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) lead our cybersecurity program in collaboration with the Company's business functions. The CIO or CISO present updates to the Audit Committee quarterly and, as necessary, to the full Board. These regular reports include updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The CIO also promptly informs and updates the Audit Committee and the Board about any information security incidents that may pose significant risk to the Company. The Company's program is periodically evaluated by external experts, and the results of those reviews are reported to the Audit Committee and the Board as necessary.


text: To more effectively prevent, detect and respond to information security threats, the Company maintains a cybersecurity program, which is supervised by the CIO whose team, including the CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Additionally, the CIO chairs the Information Security Management Committee, which is made up of senior leaders from our Information Security, Compliance, Engineering, Technical Operations, Incident Management, Corporate IT, and Human Resources teams. This committee meets quarterly and drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management and reporting.


text: Our CIO has over 30 years of experience in technology. He was appointed as our CIO in January 2022, after serving as SVP Enterprise Systems for approximately five years. Prior to that, he was Global Head of Business Systems & IT at LivePerson for approximately six years. Our CIO is certified by Oxford University for Cybersecurity for Business Leaders.


text: Our CISO has over 25 years of technology experience, with over 15 years of Information Security management experience. He was appointed as our CISO in March 2021, after serving as Director Security for approximately 2 years. Prior to that, he worked at GEP Worldwide as a Director of Security and Infrastructure Technology Management for approximately two years. Our CISO is certified for Certified Information Systems Security Professional (CISSP), and Certified Cloud Security Professional (CCSP).


text: We maintain a comprehensive technology and cybersecurity program designed to ensure our systems are effective and prepared for information security risks. Our program includes regular oversight of our systems for security monitoring for internal and external threats to maintain the confidentiality and integrity of our information assets. We have a formal, risk-based and enterprise-wide risk assessment program, which incorporates the assessment of security risk exposures, including cybersecurity risks.