text: Our key cybersecurity processes include: • Risk-based controls for information systems and information on our network. We seek to maintain an IT infrastructure that implements physical, administrative, and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity, and availability of our information systems and information stored on the Company's networks, including customer information, employee information, IP, and proprietary information. • Cybersecurity incident response plan and testing. We have a cybersecurity incident response plan and a dedicated team to respond to cybersecurity incidents. When a cybersecurity incident occurs or a vulnerability is identified, GE Vernova has cross- functional teams that are responsible for leading the initial assessment of priority and severity. External experts may also be engaged as appropriate. GE Vernova's cybersecurity team assists in responding to incidents depending on severity levels and seeks to improve our cybersecurity incident management plan through periodic tabletops or simulations at the enterprise and business levels. • Training. We provide security awareness training to help employees understand their information protection and cybersecurity responsibilities. We also provide additional role-based training to applicable employees based on customer requirements, regulatory obligations, and industry risks. • Supplier risk assessments. We have implemented a third-party risk management process that includes expectations regarding information protection and cybersecurity. That process, among other things, provides for GE Vernova to perform cybersecurity assessments on certain suppliers based on their risk profile and a related rating process. GE Vernova also seeks contractual commitments from key suppliers to appropriately secure and maintain their IT systems and protect our information that is processed on their systems. • Third-party assessments. We have third-party cybersecurity companies engaged to periodically assess GE Vernova's cybersecurity posture and assist in identifying and remediating risks from cybersecurity threats.


text: GE Vernova considers cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the enterprise level with consideration of key risk indicators, trends, and countermeasures for cybersecurity and other types of significant risks. GE Vernova does not believe that there are currently any known incidents from cybersecurity threats that are reasonably likely to materially affect GE Vernova or its business strategy, results of operations, or financial condition. As is the case for all large, global companies, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors—Risks Relating to Technology and Intellectual Property" for further information about these risks. We outsource certain cybersecurity functions and will continue to look for opportunities to utilize managed security service providers.

companyName: GE Vernova Inc.

ticker: GEV

secItem: Item 1C


text: In addition, we collaborate with GE Aerospace on certain cybersecurity functions and will continue to do so during a transition period following our Spin-Off. These arrangements increase our overall cyber risk given the degree of our interconnectedness with these third parties and the potential impact on our outsourced functions that could be caused by an attack on them.


text: The Audit Committee of the GE Vernova's Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee reports back to the full Board about this and other areas within its responsibility. As part of its oversight role, the Audit Committee receives reporting about GE Vernova's practices, programs, notable threats or incidents, and other developments related to cybersecurity throughout the year, including through periodic updates from our Chief Information Security Officer (CISO). The Audit Committee also receives information about cybersecurity risks as part of GE Vernova's enterprise risk management framework and reporting. In addition to receiving reports from the Audit Committee, the Board also periodically receives direct reports from the CISO on the Company's cybersecurity risk management.


text: GE Vernova's CISO reports to GE Vernova's Chief Information Officer and leads our overall cybersecurity function. The CISO has over 20 years of experience in managing and leading IT or cybersecurity teams and participates in various cyber security organizations. The CISO collaborates with business unit CISOs to identify and analyze cybersecurity risks to GE Vernova; consider industry trends; implement controls, as appropriate and feasible, to mitigate these risks; and enable business leaders to make risk-based business decisions that implicate cybersecurity considerations. The CISO meets with senior leadership to review and discuss GE Vernova's cybersecurity program, including emerging cyber risks, threats, and industry trends. The CISO also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with internal security personnel and business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public, or private sources to inform our cybersecurity technologies and processes.


text: ITEM 2. PROPERTIES. GE Vernova is headquartered in Cambridge, Massachusetts and occupies approximately 600 sites in 465 cities and 95 countries. Approximately 85% of the sites are leased and 15% are owned. GE Vernova periodically reviews the portfolio of facilities for opportunities to optimize and best align our footprint needs.


text: Within this portfolio of properties, GE Vernova's subsidiaries operate 91 manufacturing sites, 18 of which are located in the U.S. and 73 are located internationally. The manufacturing facilities are used by GE Vernova's segments as follows: Number of Facilities Power Electrification Total The locations of GE Vernova's manufacturing locations by geographic region are as follows: Number of Facilities Americas Association of Southeast Asian Nations (ASEAN) Europe, the Middle East, and Africa (EMEA) Total In addition to the manufacturing facilities described above, GE Vernova maintains many offices, warehouses, and distribution facilities globally.


text: Many of our facilities serve several of our businesses and may be used for multiple purposes, such as for administration, sales, research, laboratory matters, manufacturing, and service operations. We consider our facilities suitable and adequate for their respective purposes and do not anticipate difficulty in renewing existing leases as they expire or finding alternative facilities if necessary.


text: Securing Bunge's business information, customer, supplier, and employee data and information technology systems is an important part of our overall risk management framework. We rely on certain key information technology systems, some of which are dependent on services provided by third parties, to provide critical data and services for internal and external users, including procurement and inventory management, transaction processing, financial, commercial and operational data, human resources management, legal and tax compliance, and other information and processes necessary to operate and manage our business.

companyName: Bunge Global SA

ticker: BG


text: Our cybersecurity risk management program monitors our systems and networks for threats, breaches, intrusions and other weaknesses; assesses the security of our company-wide software, applications and systems; conducts security audits and threat assessments; responds to cybersecurity incidents; and facilitates training for our employees. Within our cybersecurity team, subject matter experts regularly obtain cybersecurity certifications. Our program includes procedures to identify cybersecurity risks and threats of our third-party service providers. These procedures measure the maturity of third-party provider cybersecurity programs against industry best practices. The collection of this information is used to assess the use of third-party software or partnerships. We also review the cybersecurity scores of our business customers and suppliers, and we rely on consultants and other third-party advisors to conduct security assessments and independent audits of the security and resilience of our systems and networks. Our cybersecurity risk management program includes response plans that are aligned with our crisis response plans and outline the procedures and protocols to follow when a cybersecurity incident has or may have occurred, including to allow assessments related to disclosure and notice requirements to be timely made to regulators and affected parties. The response plan includes protocols to notify our Chief Technology Officer ("CTO"), our Chief Legal Officer, other members of senior management as appropriate, and, under certain circumstances, the Audit Committee of our Board, or our full Board as appropriate.


text: We have integrated cybersecurity risk assessments into Bunge's overall enterprise risk management framework to promote a company-wide culture of cybersecurity risk management. Our CRO formulates periodic reports and provides them to our Management Risk Committee ("MRC"). As noted in "Item 1. Business - Risk Management", the MRC reviews key enterprise risks on an ongoing basis and is responsible for reviewing and monitoring key exposures, emerging risks, and drivers of risk.


text: Increased global cybersecurity vulnerabilities, threats, and more sophisticated and targeted cybersecurity attacks, including those tied to global conflicts, pose a potentially significant risk to the security of our information technology systems, networks and services, as well as the confidentiality, availability and integrity of our data and the confidential data of our employees, customers, suppliers, and other third parties that we may hold. Although, to date, we have not experienced a material cybersecurity incident resulting in a significant interruption of our operations, the scope of any future incident cannot be predicted with any meaningful accuracy. See "Item 1A. Risk Factors" for more information.


text: Our CTO leads our Business Technology organization and our cybersecurity risk management program in coordination with our CRO. The Business Technology team is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our CTO and CRO regularly receive briefings on cybersecurity matters, and in turn our CTO regularly reports to the Audit Committee on such matters. Our CRO regularly reports on enterprise risks facing the Company to the ERMC. Our CTO has more than 20 years of experience in leading, managing, and transforming information technology systems for large, global organizations, and our CRO has several years of experience in leading and managing risk oversight for global organizations.


text: Our Board oversees Bunge's approach to risk management. Our Board has established a dedicated Board committee, the Enterprise Risk Management Committee, which enables greater focus at the Board level on risk oversight tailored to our business and industries. Additionally, each of our other Board committees is responsible for considering risks within its area of responsibility. The Board has delegated oversight and review of risks related to cybersecurity and information technology systems to the Audit Committee.


text: The Audit Committee is responsible for reviewing and assessing the overall cybersecurity risk management program and management's processes and policies with respect to cybersecurity risk monitoring, identification, assessment, and response. Senior management and the Audit Committee receive at least quarterly updates on Bunge's cybersecurity readiness and the current "threat environment," which includes an update on the cybersecurity threat landscape, the strategic priorities of the cybersecurity risk management program and progress made in respect of those priorities, a review of cybersecurity incidents, as well as additional updates on an as-needed basis. Our internal audit team also reports to the Audit Committee on the effectiveness of management in identifying and appropriately controlling risks, including cybersecurity risks. The Audit Committee regularly reports on its activities to the full Board to promote effective coordination and to ensure that the entire Board remains apprised of the effectiveness of the cybersecurity risk management and the cybersecurity risk landscape, and also assesses how management is managing these risks.


text: Our cybersecurity risk management program monitors our systems and networks for threats, breaches, intrusions and other weaknesses; assesses the security of our company-wide software, applications and systems; conducts security audits and threat assessments; responds to cybersecurity incidents; and facilitates training for our employees. Within our cybersecurity team, subject matter experts regularly obtain cybersecurity certifications. Our program includes procedures to identify cybersecurity risks and threats of our third-party service providers. These procedures measure the maturity of third-party provider cybersecurity programs against industry best practices. The collection of this information is used to assess the use of third-party software or partnerships. We also review the cybersecurity scores of our business customers and suppliers, and we rely on consultants and other third-party advisors to conduct security assessments and independent audits of the security and resilience of our systems and networks. Our cybersecurity risk management program includes response plans that are aligned with our crisis response plans and outline the procedures and protocols to follow when a cybersecurity incident has or may have occurred, including to allow assessments related to disclosure and notice requirements to be timely made to regulators and affected parties. We have also performed and plan to continue to conduct cybersecurity incident simulation exercises involving members of senior management as part of our cybersecurity risk management program. The Board is provided with an update following a simulation exercise. Our response plans include protocols to notify our Chief Technology Officer ("CTO"), our Chief Legal Officer, other members of senior management as appropriate, and, under certain circumstances, the Audit Committee of our Board, or our full Board as appropriate.


text: Our worldwide team of cyber and information security professionals undertakes a range of activities to protect its employees, assets, and reputation globally, leveraging internal and external resources to monitor cybersecurity threats to its systems and networks and to understand the broader threat environment. In support of these efforts, Our security experts use automated threat intelligence feeds and tools to increase vulnerability awareness, taking action to mitigate the highest risks.


text: Bunge's dedicated cyber risk organization meets regularly with business units and corporate operations to raise cyber risk awareness and keep diverse cybersecurity skill sets connected across the global enterprise. We invest in broad cybersecurity awareness and training to educate those with access to Bunge's networks, which includes a review of company policies and best practices. We conduct phishing tests to train our workforce, and assess its ability, to identify and report malicious emails and activity. Privacy and data protection awareness and training is provided to employees and the Board as part of Bunge's required Code of Conduct training.


text: We have integrated cybersecurity risk assessments into Bunge's overall enterprise risk management framework to promote a company-wide culture of cybersecurity risk management. Our CRO formulates periodic reports and provides them to our Management Risk Committee ("MRC"). As noted in "Item 1. Business - Risk Management", the MRC reviews key enterprise risks on an ongoing basis and is responsible for reviewing and monitoring key exposures, emerging risks, and drivers of risk. Bunge uses a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize, and mitigate cybersecurity risks, which is periodically assessed by an independent third party.


text: Increased global cybersecurity vulnerabilities, threats, and more sophisticated and targeted cybersecurity attacks, including those tied to global conflicts, pose a potentially significant risk to the security of our information technology systems, networks and services, as well as the confidentiality, availability and integrity of our data and the confidential data of our employees, customers, suppliers, and other third parties that we may hold.


text: Although we have experienced and will continue to experience cybersecurity incidents of varying degrees, to date, we have not experienced a cybersecurity incident that has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Despite the measures the company takes to mitigate cybersecurity risks, there can be no assurance that such measures will be sufficient to protect the company's systems, information, intellectual property,and other assets from significant harm and, therefore, the scope and impact of any future cybersecurity incident cannot be predicted with any meaningful accuracy. See "Item 1A. Risk Factors" for more information.


text: The Audit Committee is responsible for reviewing and assessing the overall cybersecurity risk management program and management's processes and policies with respect to cybersecurity risk monitoring, identification, assessment, and response. Senior management and the Audit Committee receive an annual update and ongoing quarterly updates on Bunge's cybersecurity readiness and the current "threat environment," which includes an update on the cybersecurity threat landscape, the strategic priorities of the cybersecurity risk management program and progress made in respect of those priorities, a review of cybersecurity incidents, as well as additional updates on an as-needed basis. Our internal audit team also reports to the Audit Committee on the effectiveness of management in identifying and appropriately controlling risks, including cybersecurity risks. The Audit Committee regularly reports on its activities to the full Board to promote effective coordination and to ensure that the entire Board remains apprised of the effectiveness of the cybersecurity risk management and the cybersecurity risk landscape, and also assesses how management is managing these risks.


text: We collect, store, process and use data necessary to conduct our business, including information regarding our customers and employees in digital form. Data maintained in digital form is subject to unauthorized access, modification, theft, misuse or other cybersecurity risks.

companyName: WEBTOON Entertainment Inc.

ticker: WBTN


text: We maintain comprehensive processes to assess, identify, and manage material risks from internal and external cybersecurity threats, and have integrated such processes into our overall enterprise risk management systems and processes. We regularly assess our cybersecurity threats based on industry leading frameworks, including ISO 27001, ISO 27701 and National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Assessments are performed by dedicated cybersecurity teams led by our Chief Information Security Officer and Data Protection Officer (CISO and DPO) to identify risks related to data loss, theft, misuse and other cybersecurity risks. Following such risk assessments, we design and implement safeguards to prevent and mitigate identified risks based on our risk management methodology. Additionally, we regularly conduct cybersecurity/privacy awareness training, phishing attack simulation training, disaster recovery training and other tabletop exercises to improve our practices.


text: To maintain the highest levels of cybersecurity, we engage independent third-party experts to assess and audit our cybersecurity and obtain cybersecurity certifications, including ISO 27001, ISO 27701 and/or SOC2 on our key services. Our insurance coverage addresses certain financial exposures related to cybersecurity incidents. Although, we have not experienced any material cybersecurity incidents, we face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Despite our efforts, the risk of unauthorized access, modification, theft, misuse and other cybersecurity attacks cannot be eliminated entirely. We have experienced, and may continue to experience, cybersecurity incidents in our normal course of business. See "Risk Factors — Risks Related to Our Business, Industry and Operations — If the security of our platform is compromised, it could compromise our and our creators' and users' personal, sensitive, confidential and proprietary information, disrupt our internal operations and harm public perception of our platform, which could adversely affect our business and reputation."


text: We use third party systems and software and provide personal information about customers and employees to third parties in certain cases. We assess the cybersecurity of third party service providers and regularly conduct access review. We may decline or terminate the engagement with certain third party service providers if we determine that the use of their services would increase our exposure to cybersecurity risks.


text: Our CISO and DPO serves as the chair of the IT Compliance Committee, which directly reports to our CEO. The IT Compliance Committee also includes key representatives from management, and is responsible for reviewing IT planning, cybersecurity and privacy, and managing our cybersecurity teams. The IT Compliance Committee, upon reviewing assessment results regularly reported by cybersecurity teams, provides periodic updates to the Audit Committee on the effectiveness of our cybersecurity processes, and the Audit Committee reviews cybersecurity risks as part of the Company's enterprise risk management system. The Audit Committee periodically reports the results of its review to the Board. When a cybersecurity incident occurs, information is escalated to the CISO and DPO who may convene IT Compliance Committee meetings to discuss findings, actions taken, potential disclosure obligations, impact and recurrence prevention plan depending on the severity of the incident.


text: The IT Compliance Committee members rely on the cybersecurity experience of our CISO and DPO, which includes more than 20 years of directing privacy policies at public companies that provide web portal and instant messenger services, and managing cybersecurity and privacy policies at a game developer company. All IT Compliance Committee members have robust experience in their respective fields as well as a general familiarity with cybersecurity matters and an understanding of the potential financial impacts, disclosure obligations, and enterprise risks to the Company as they relate to cybersecurity.


text: As described under Item 1A in this Form 10-K, the Combined Company is subject to risks from cybersecurity threats, including risks relating to maintaining customer and employee data. Cybersecurity is a key focus at multiple levels of the organization, and management has developed policies and procedures to assess, identify and manage risks from cybersecurity threats.

companyName: Six Flags Entertainment Corporation/NEW

ticker: FUN


text: – Board of Directors – Enterprise risk management ("ERM") process: As part of the ERM process, executive management and the Board of Directors regularly review an assessment related to cybersecurity and data protection risks to identify material risk areas, assess processes to mitigate those risks, and identify process and procedure improvements to alleviate identified risks, including allocating appropriate resources. Cybersecurity and data protection focus areas of ERM include phishing, malware, data breaches, outdated software, staffing levels for key information technology positions, and risks associated with the use of third parties. – Audit and Finance Committee of the Board of Directors: The Audit and Finance Committee is responsible for discussing the Combined Company's major information technology risk exposures, including cybersecurity, and the steps management has taken to monitor and control such exposures. The Audit and Finance Committee dedicates attention to and provides oversight of certain cybersecurity risks. The Chief Digital and Technology Officer and Corporate Vice President, IT Infrastructure Operations and Security, meet with the Audit and Finance Committee regularly to assess management's progress on implementing process and procedure improvements related to cybersecurity. The Audit and Finance Committee also provides guidance on long-term and short-term cybersecurity strategies.


text: –Executive Management – Technology Governance Committee: The Technology Governance Committee consists of certain members of executive management, including the Chief Accounting Officer, Chief Digital and Technology Officer, Chief Commercial Officer, Chief Strategy Officer, and Corporate Vice President, IT Infrastructure Operations and Security. This committee evaluates projects involving information technology, including reviewing best practices and change management needs and communicating a company-wide approach. Therefore, the information technology department is aware of system and application implementations prior to execution to facilitate proper application and infrastructure security both during implementation and after implementation. Internal audit is notified of system and application implementations as part of this process as well. The internal audit department works with the information technology department to review information technology projects to ensure key projects are appropriately planned, designed, developed, tested, deployed and maintained, including verifying proper security both during and after implementation.


text: –Information Technology Department: The information technology department consists of employees with extensive cybersecurity experience, including the Chief Digital and Technology Officer and Corporate Vice President, IT Infrastructure Operations and Security, as well as a team of compliance and security associates. Cybersecurity experience within the information technology department includes prior work experience and bachelor's degrees or higher in technology related fields. In addition to internal resources, management engages a cyber insurance carrier with comprehensive data privacy and security risk management services; a managed security service provider with comprehensive security solutions, including continuous network monitoring, reporting and assistance with investigation; and an information security consulting company that consists of cybersecurity experts and information security practitioners to provide additional cybersecurity support. Management also maintains a system of information technology controls and procedures, including controls and procedures related to authentication and access, recovery plans and secured backups of data, the design of applications and selection of packaged software, and testing of significant changes in applications and infrastructure technology. Management also provides training to its employees about cybersecurity, performs penetration testing at least annually, performs security incident preparedness activities at least annually, and performs an annual Payment Card Industry ("PCI") attestation. Third party providers involving information technology are identified as part of the contract review process. System and Organizational Controls ("SOC") reports are reviewed annually for third party providers. The information technology department continuously monitors for cybersecurity threats in order to detect if a cybersecurity incident has occurred. The department uses endpoint detection and response ("EDR") and security information and event management ("SIEM") with the assistance of a managed security service provider and internal analysts to detect and identify threats. Lastly, management follows the National Institute of Standards and Technology ("NIST") Framework, which enables management to compare the Company against the industry and manage dynamic cybersecurity risks.


text: If a cybersecurity incident were to occur, including a cybersecurity incident associated with a third-party provider, management has developed an incident response plan to align responsibilities throughout the organization to facilitate an efficient and effective response, as well as an appropriate investigation of each incident. The incident response plan is led by executive management, the Chief Digital and Technology Officer, the Corporate Vice President, IT Infrastructure Operations and Security, and the information technology department and includes a further delegation of incident responsibility to key internal stakeholders, including the legal, investor relations, human resources, and internal audit departments. Upon identification of an incident, each incident is assigned an incident materiality rating based on both quantitative and qualitative considerations. Qualitative considerations include the presence of ransomware, operational degradation or interruption, operational loss, and sensitive or confidential data loss. Based on the severity of each incident, the incident response is escalated. Cybersecurity incidents, regardless of materiality, are investigated by the information technology department led by Corporate Vice President, IT Infrastructure Operations and Security and are communicated to the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Digital and Technology Officer, the Executive Chairman of the Board of Directors, Lead Independent Director and the Chair of the Audit and Finance Committee. The entire Board of Directors is notified of material or high-risk incidents.


text: Risks from cybersecurity threats could materially affect the Combined Company's business strategy, results of operations or financial condition as described under Item 1A in this Form 10-K. There are no known risks from cybersecurity incidents that have materially affected or are reasonably likely to materially affect the registrant as of the date of this filing.


text: As a community bank, we rely heavily on information technology and telecommunications systems to conduct our business activities, such as processing transactions, maintaining records, communicating with customers and vendors, and providing online and mobile banking services. These systems are subject to various cybersecurity threats, such as unauthorized access, hacking, phishing, malware, ransomware, denial-of-service attacks, and other malicious or criminal activities, that could compromise the confidentiality, integrity, or availability of our systems, data, or customer information. Cybersecurity threats may originate from external sources, such as cybercriminals, hackers, terrorists, or foreign governments, or from internal sources, such as employees, contractors, or vendors. Cybersecurity threats may also target our third-party service providers, such as core processors, cloud providers, or payment processors, whose systems and data are interconnected with ours.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: We have implemented various security measures and controls to protect our systems and data from unauthorized access, use, or disclosure, such as firewalls, encryption, authentication, backup, and recovery, both internally and with our third party managed service provider. We also have established policies and procedures to monitor and respond to cybersecurity incidents, and to comply with applicable laws and regulations regarding cybersecurity and data privacy. We regularly review and update our security measures and controls to address the evolving nature and sophistication of cybersecurity threats. We also provide training and education to our employees and customers on cybersecurity awareness and best practices. In addition, we maintain cyber liability insurance coverage to mitigate the potential financial impact of cybersecurity incidents. Furthermore, internal and external auditors and regulators periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain a Business Continuity and Incident Response Program that provides a documented framework for responding to actual or potential incidents, including engagement of appropriate third parties such as insurance providers and incident response professionals, and timely reporting to our CEO and Board of Directors as appropriate. The Business Continuity and Incident Response Program is coordinated by the Information Security Officer and key members of management are embedded into the Plan by its design. The Business Continuity and Incident Response Program facilitates coordination across multiple areas of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is always present. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. Despite our efforts, we cannot guarantee that our security measures and controls will be sufficient or effective to prevent, detect, or mitigate all cybersecurity incidents or to protect our systems and data from unauthorized access, use, or disclosure. We may experience cybersecurity incidents in the future that could result in operational disruption, reputational damage, customer dissatisfaction, loss of business or revenue, legal liability, regulatory actions, fines, penalties, or remediation costs. Any of these outcomes could have a material adverse effect on our business, operations, and financial condition. While we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected the Corporation to date.


text: We rely on the information technology and systems maintained by Pillar and their employees to identify and manage material risks from cybersecurity threats. Pillar takes various actions, and incurs significant costs, to maintain and manage the operation and security of information technology and systems, including the data maintained in those systems. We believe that Pillar's Director of Information Technology and his associates endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology and CIS Critical Security Controls frameworks. Since we rely on accounting, financial, operational, management and other information systems, including the Internet and third-party hosted services to conduct our operations, store personal and sensitive data, process financial information and results of operations for internal reporting purposes and comply with financial reporting, legal and tax requirements, we have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include, but are not limited to (i) maintaining a defined and practiced incident response plan; (ii) employing appropriate incident prevention and detection safeguards; (iii) maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; (iv) educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and (v) reviewing and evaluating new developments in the cyber threat landscape. Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support in evaluating, monitoring and testing our cybersecurity management systems and related cyber risks.

companyName: INCOME OPPORTUNITY REALTY INVESTORS INC /TX/

ticker: IOR


text: Audit Committee of the Board of Directors oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from Pillar's Director of Information Technology regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, a detailed incident response plan is in place for contacting authorities and informing key stakeholders, including management. We do not believe we are reasonably likely to be materially affected from cybersecurity threats, including as a result of previous incidents.


text: Sponsor, its parent Valkyrie Investments Inc., and their respective affiliates (collectively, "Valkyrie") have adopted an organizational wide cybersecurity program. The program is administered by the Chief Compliance Officer ("CCO") of Valkyrie Funds, LLC, an affiliate of the Sponsor and wholly-owned subsidiary of Valkyrie Investments Inc. Valkyrie's objective, in the development and implementation of this comprehensive cybersecurity program, is to create effective administrative, technical, and physical safeguards for the protection of personal information of the organization and its clients.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Valkyrie has designated the CCO to implement and maintain the cybersecurity program. The CCO may delegate any of the CCO's responsibilities to appropriate designees as long as the CCO remains primarily responsible for compliance oversight and administration. The CCO will is responsible for: Initial implementation of the cybersecurity program; employee education; testing of the cybersecurity program's safeguards;


text: Evaluating the ability of each of our third party service providers to implement and maintain appropriate security measures for the personal information to which we have permitted them access, and requiring such third party service providers by contract to implement and maintain appropriate security measures.


text: Reviewing the scope of the security measures in the cybersecurity program at least annually, or whenever there is a material change in our business practices that may implicate the security or integrity of records containing personal information.


text: of Risks and Cybersecurity Governance combat internal risks to the security, confidentiality, and/or integrity of any electronic records containing personal information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, Valkyrie has identified the following risks that are present to its business as well as procedures to help mitigate those risks: Internal Threats There must be communication to employees on the detailed provisions of the cybersecurity program at onboarding and annually.


text: Access to records containing client's personal information shall be limited to those persons who are reasonably required to know such information.


text: All security measures shall be reviewed at least annually, or whenever there is a material change in our business practices that may reasonably implicate the security or integrity of records containing personal information.


text: Terminated employees must return all records containing personal information, in any form, that may at the time of such termination be in the former employee's possession.


text: A terminated employee's physical and electronic access to personal information must be immediately blocked. Such terminated employee shall be required to surrender all keys, IDs or access codes or badges, business cards, and the like, that permit access to the firm's premises or information. Moreover, such terminated employee's remote electronic access to personal information must be disabled; his/her voicemail access, e-mail access, internet access, and passwords must be invalidated. employees' user ID's and passwords must be managed in accordance to Valkyrie's password policy. are encouraged to report any suspicious or unauthorized use of customer information.


text: Employees are prohibited from keeping open files containing personal information on their computer screen when they are not at their desks. Employees are responsible for locking computer screen when away from workspace. must not share login information with co-workers.


text: Valkyrie will maintain reasonably up-to-date firewall protection (if applicable) and operating system security patches, reasonably designed to maintain the integrity of the personal information, installed on systems processing personal information.


text: Valkyrie will maintain reasonably up-to-date versions of system security agent software which must include malware protection and reasonably up-to-date patches and virus definitions, installed the extent technically feasible, personal information stored on portable devices, such as laptops or tablets, must be password protected, as must all records and files transmitted across public networks or wirelessly, to the extent technically feasible. computer systems must be monitored for unauthorized use of or access to personal information.


text: Valkyrie does not provide its clients with online account access nor does process funds transfer requests. If the firm's business changes to allow for remote client access and funds transfer requests, Valkyrie will update the cybersecurity program accordingly by identifying the potential risks involved and implementing the appropriate safeguards to protect the client's personal information.


text: Associated with Vendors and Other Third Parties periodically conducts risk assessments with vendors and other third parties that have access to the Firm's networks, customer data, and other sensitive information.


text: Risk Assessment and Strategy The Company regularly evaluates cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors.

companyName: SOLESENCE, INC.

ticker: SLSN


text: The use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.


text: The deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities. If necessary, the use of third-party security experts if and when an incident is detected.


text: We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions.


text: Management Oversight Day-to-day management of cybersecurity threats is conducted by our information technology consultant which is charged with identifying and reporting threats to senior management. The Board of Directors is responsible for oversight of management's efforts to eliminate cybersecurity risks.


text: Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Fund. The Sponsor has an information security program and policy in place, as mandated by new Regulation S-K Item 106. This program is designed to assess, identify, and manage material risks from cybersecurity threats. Regular reviews of cybersecurity and information technology plans are conducted for key service providers, as part of the Sponsor's disaster recovery and business continuity planning process. Additionally, the Sponsor evaluates whether any cybersecurity threats, including those resulting from previous incidents, have materially affected or are reasonably likely to materially affect the Trust and the Fund.

companyName: Hashdex Commodities Trust

ticker: DEFI


text: The Sponsor's Vice President of IT & Cybersecurity, Mr. Tiago DeMesquita, is responsible for identifying, assessing and managing the Sponsor's risks from cybersecurity threats. Mr. DeMesquita has over 5 years of experience in technology and cybersecurity. Mr. DeMesquita heads the Cybersecurity Committee of the Sponsor which meets regularly to evaluate strategies, governance, risk management, compliance, engineering and development, security operations, and incident management. In addition, the Sponsor maintains a cybersecurity insurance policy.


text: Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats.

companyName: Tonix Pharmaceuticals Holding Corp.

ticker: TNXP


text: During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors.


text: To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of a wide array of policies, standards, architecture, and processes. The cyber risk management program falls under the responsibility of our Director of Information Technology ("IT"), who has cross-functional expertise in IT, computer science, cyber security, and more than 20 years of experience. The IT Director leads a team of IT specialists with similar IT and cybersecurity backgrounds. Under the guidance of our IT Head, we develop, maintain, and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements. We also utilize a variety of cybersecurity software from reputable vendors in cybersecurity.


text: We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and ensure the effectiveness of our security controls. Our cybersecurity risk management program is intended to address applicable NIST 800-171 & CMMC requirements for our business. Our cybersecurity risk management program incorporates several components, including information security program assessments, continuous monitoring of critical risks from cybersecurity threats using automated tools, backup testing, periodic threat testing, and documented standards, policies, and procedures. We deploy a wide range of security tools across the environment, and implement access control policies to further limit access to data within the systems.


text: We periodically engage third parties to conduct risk assessments, including penetration testing, tabletops and other system vulnerability analyses. As a result of these assessments and testing, we have not identified any material cybersecurity risks and are constantly hardening our environment. Additionally, our program includes annual cybersecurity training for all employees. Our Board of Directors ("Board")


text: is responsible for the oversight of cybersecurity risk management. The Board delegates oversight of the cybersecurity risk management program to the Information Security Oversight Committee ("ISOC"). The Chief Financial Officer ("CFO"), who serves on ISOC, provides updates to the Audit Committee on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on a quarterly basis.


text: The CFO also notifies the Board and Audit Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.


text: Cybersecurity risk management is an important part of our overall risk management efforts. We maintain a cybersecurity program that is comprised of policies, procedures, controls and plans whose objective is to help us prevent and effectively respond to cybersecurity threats or incidents. Through our cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential attack vectors to company systems. We maintain various measures to safeguard against cybersecurity threats such as monitoring systems, security controls, policy enforcement, data encryption, employee training, tools and services from third-party providers and management oversight to assess, identify and mitigate risks from cybersecurity threats. We conduct regular testing of these controls and systems including vulnerability scanning, penetration testing and simulating the execution of parts of our disaster recovery plan. All employees are required to pass a mandatory cybersecurity training course on an annual basis and we regularly conduct phishing simulations to train our employees on how to recognize phishing attempts. have implemented cybersecurity frameworks, policies and practices which incorporate industry-standards and contractual requirements.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: We also contractually flow cybersecurity regulatory requirements to our subcontractors as required by the Defense Federal Acquisition Regulation Supplement and other government agency specific requirements. These contractual flow downs include the requirement that our subcontractors implement certain information security controls. Additionally, we gather information and review the SOC-2 reports of certain third-parties who integrate with our systems, such as our payroll processor, managed solutions provider and software as a service providers on an annual basis to identify and manage risk. We continuously evaluate and seek to improve and mature our cybersecurity processes. We apply lessons learned from our defense and monitoring efforts to help prevent future attacks and utilize data analytics to detect anomalies and search for cyber threats. Additionally, our Internal Audit function regularly assesses our program effectiveness through audits of systems and processes to help maintain compliance with policies.


text: Cybersecurity threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our board of directors has oversight of our strategic and business risk management and oversees management's execution of our cybersecurity risk management program. The board receives regular updates from management on our cybersecurity risks. In addition, management updates the board as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact potential. Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the board, as appropriate.


text: Vice President of Human Resources & Administration ("VP HR&A") leads our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response.


text: The VP HR&A manages a team of information technology professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, incident response, insider threats and regulatory compliance.


text: Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration.


text: With oversight from our board of directors, our advisor and our senior management have implemented an enterprise-wide information security program designed to identify, protect against, detect, assess, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our cybersecurity processes have been integrated into our overall risk management system. To protect our information systems from cybersecurity threats, our advisor uses various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. Our advisor also employs third parties to identify, prioritize, assess, mitigate and remediate information system risks; however, our advisor relies on such third parties to implement security programs commensurate with their risk, and our advisor cannot ensure in all circumstances that their efforts will be successful.

companyName: Moody National REIT II, Inc.


text: Our advisor regularly assesses risks from cybersecurity and technology threats and monitors our information systems for potential vulnerabilities. Our advisor uses a risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. Our advisor conducts regular reviews and tests of our information security program to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: The results of these assessments are reported to our senior management. and our advisor's systems could potentially experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. Any significant disruption to our or our advisor's operations or access to our or our advisor's systems could adversely affect our business and results of operation. Further, a penetration of our or our advisor's systems or a third-party's systems or other misappropriation or misuse of personal information could subject our advisor or us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See " Risk Factors - Operational risks, including the risk of cyberattacks, may disrupt our businesses, result in losses or limit our growth. "


text: Our advisor's Vice President - Communications leads our advisor's information security group responsible for overseeing our information security program. Our advisor's Vice President - Communications has over 18 years of industry experience.


text: Team members who support our advisor's information security program have relevant educational and industry experience. The teams, led by our advisor's Vice President – Communications, provide regular reports to our senior management and other relevant teams on various cybersecurity threats, assessments and findings. Our board of directors receives updates regarding cybersecurity issues as and when deemed necessary by our senior management.


text: Our advisor experienced a security incident in January 2023 that impacted the operability of its computer systems. Our advisor promptly reported the incident to federal law enforcement and restored the functionality of its computer systems. We are unaware of any misuse of our information.


text: Senior management oversees our annual enterprise risk assessment, where we assess key risks within our company, including security and technology risks and cybersecurity threats, oversees our cybersecurity risk, and receives regular reports from our Vice President - Communications on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Processes for Assessing, Identifying, and Managing Threats rely on the information technology and systems maintained by Pillar and their employees to identify and manage material risks from cybersecurity threats. Pillar takes various actions, and incurs significant costs, to maintain and manage the operation and security of information technology and systems, including the data maintained in those systems. We believe that Pillar's Director of Information Technology and his associates endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology and CIS Critical Security Controls frameworks. Since we rely on accounting, financial, operational, management and other information systems, including the Internet and third-party hosted services to conduct our operations, store personal and sensitive data, process financial information and results of operations for internal reporting purposes and comply with financial reporting, legal and tax requirements, we have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include, but are not limited to (i) maintaining a defined and practiced incident response plan;


text: (ii) employing appropriate incident prevention and detection safeguards; (iii) maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; (iv) educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and (v) reviewing and evaluating new developments in the cyber threat landscape. Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support in evaluating, monitoring and testing our cybersecurity management systems and related cyber risks.


text: Audit Committee of the Board of Directors oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from Pillar's Director of Information Technology regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, a detailed incident response plan is in place for contacting authorities and informing key stakeholders, including management. We do not believe we are reasonably likely to be materially affected from cybersecurity threats, including as a result of previous incidents.


text: Sponsor has adopted an organizational wide cybersecurity program. The program is administered by the Head of IT of the Sponsor (the "Head of IT"). The Sponsor's objective, in the development and implementation of this comprehensive cybersecurity program, is to create effective administrative, technical, and physical safeguards for the protection of personal information of the organization and its clients.


text: Sponsor has designated the Head of IT to implement and maintain the cybersecurity program. The Head of IT may delegate any of the Head of IT's responsibilities to appropriate designees as long as the Head of IT remains primarily responsible for compliance oversight and administration. The Head of IT will is responsible for: Initial implementation of the cybersecurity program; employee education; testing of the cybersecurity program's safeguards;


text: Evaluating the ability of each of our third party service providers to implement and maintain appropriate security measures for the personal information to which we have permitted them access, and requiring such third party service providers by contract to implement and maintain appropriate security measures.


text: Reviewing the scope of the security measures in the cybersecurity program at least annually, or whenever there is a material change in our business practices that may implicate the security or integrity of records containing personal information.


text: of Risks and Cybersecurity Governance combat internal risks to the security, confidentiality, and/or integrity of any electronic records containing personal information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, the Sponsor has identified the following risks that are present to its business as well as procedures to help mitigate those risks: Internal Threats There must be communication to employees on the detailed provisions of the cybersecurity program at onboarding and annually.


text: Access to records containing client's personal information shall be limited to those persons who are reasonably required to know such information.


text: All security measures shall be reviewed at least annually, or whenever there is a material change in our business practices that may reasonably implicate the security or integrity of records containing personal information.


text: Terminated employees must return all records containing personal information, in any form, that may at the time of such termination be in the former employee's possession.


text: A terminated employee's physical and electronic access to personal information must be immediately blocked. Such terminated employee shall be required to surrender all keys, IDs or access codes or badges, business cards, and the like, that permit access to the firm's premises or information. Moreover, such terminated employee's remote electronic access to personal information must be disabled; his/her voicemail access, e-mail access, internet access, and passwords must be invalidated. employees' user ID's and passwords must be managed in accordance to the Sponsor's password policy. are encouraged to report any suspicious or unauthorized use of customer information.


text: Employees are prohibited from keeping open files containing personal information on their computer screen when they are not at their desks. Employees are responsible for locking computer screen when away from workspace. must not share login information with co-workers.


text: Sponsor will maintain reasonably up-to-date firewall protection (if applicable) and operating system security patches, reasonably designed to maintain the integrity of the personal information, installed on systems processing personal information.


text: Sponsor will maintain reasonably up-to-date versions of system security agent software which must include malware protection and reasonably up-to-date patches and virus definitions, the extent technically feasible, personal information stored on portable devices, such as laptops or tablets, must be password protected, as must all records and files transmitted across public networks or wirelessly, to the extent technically feasible. computer systems must be monitored for unauthorized use of or access to personal information.


text: Associated with Remote Client Access and Funds Transfer Requests the Sponsor does not provide its clients with online account access nor does process funds transfer requests. If the firm's business changes to allow for remote client access and funds transfer requests, the Sponsor will update the cybersecurity program accordingly by identifying the potential risks involved and implementing the appropriate safeguards to protect the client's personal information.


text: Sponsor periodically conducts risk assessments with vendors and other third parties that have access to the Firm's networks, customer data, and other sensitive information.


text: of Unauthorized Activity who believe their terminal or computer systems have been subjected to unauthorized activity, or has otherwise been improperly accessed or used, are required to report the situation to the Head of IT immediately to determine the course of action.


text: Sponsor takes the issue of security seriously. Firm employees who use the technology and information resources of the firm must be aware that they can be disciplined if they violate this policy. Upon violation of this policy, an employee may be subject to discipline up to and including discharge. The specific discipline imposed will be determined by a case-by-case basis, taking into consideration the nature and severity of the violation of the cybersecurity program, prior violations of the policy committed by the individual, state and federal laws and all other relevant information.


text: In a case where the accused person is not a firm employee, the matter shall be submitted to the Head of IT. The Head of IT may refer the information to law enforcement agencies and/or prosecutors for consideration as to whether criminal charges should be filed against the alleged violator(s).


text: Company regularly evaluates cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors.


text: Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.


text: The deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities. necessary, the use of third-party security experts if and when an incident is detected.


text: We are not aware of having experienced any material cybersecurity incidents in 2024. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions.


text: Day-to-day management of cybersecurity threats is conducted by our information technology consultant which is charged with identifying and reporting threats to senior management, which then reports to the Board of Directors. Board of Directors is responsible for oversight of management's efforts to eliminate cybersecurity risks.


text: Processes for Assessing, Identifying, and Managing Threats [Text Block] oversight from our board of directors, our advisor and our senior management have implemented an enterprise-wide information security program designed to identify, protect against, detect, assess, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our cybersecurity processes have been integrated into our overall risk management system. To protect our information systems from cybersecurity threats, our advisor uses various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. Our advisor also employs third parties to identify, prioritize, assess, mitigate and remediate information system risks; however, our advisor relies on such third parties to implement security programs commensurate with their risk, and our advisor cannot ensure in all circumstances that their efforts will be successful.


text: Our advisor regularly assesses risks from cybersecurity and technology threats and monitors our information systems for potential vulnerabilities. Our advisor uses a risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. Our advisor conducts regular reviews and tests of our information security program to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: The results of these assessments are reported to our senior management. and our advisor's systems could potentially experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. Any significant disruption to our or our advisor's operations or access to our or our advisor's systems could adversely affect our business and results of operation. Further, a penetration of our or our advisor's systems or a third-party's systems or other misappropriation or misuse of personal information could subject our advisor or us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See " Risk Factors - Operational risks, including the risk of cyberattacks, may disrupt our businesses, result in losses or limit our growth. "


text: Cybersecurity Risk Board of Directors Oversight [Text Block] advisor's Vice President - Communications leads our advisor's information security group responsible for overseeing our information security program. Our advisor's Vice President - Communications has over 18 years of industry experience.


text: Team members who support our advisor's information security program have relevant educational and industry experience. The teams, led by our advisor's Vice President – Communications, provide regular reports to our senior management and other relevant teams on various cybersecurity threats, assessments and findings. Our board of directors receives updates regarding cybersecurity issues as and when deemed necessary by our senior management.


text: Senior management oversees our annual enterprise risk assessment, where we assess key risks within our company, including security and technology risks and cybersecurity threats, oversees our cybersecurity risk, and receives regular reports from our Vice President - Communications on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Cybersecurity risk management is an important part of our overall risk management efforts. We maintain a cybersecurity program that is comprised of policies, procedures, controls and plans whose objective is to help us prevent and effectively respond to cybersecurity threats or incidents. Through our cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential attack vectors to company systems. We maintain various measures to safeguard against cybersecurity threats such as monitoring systems, security controls, policy enforcement, data encryption, employee training, tools and services from third-party providers and management oversight to assess, identify and mitigate risks from cybersecurity threats. We conduct regular testing of these controls and systems including vulnerability scanning, penetration testing and simulating the execution of parts of our disaster recovery plan. All employees are required to pass a mandatory cybersecurity training course on an annual basis and we regularly conduct phishing simulations to train our employees on how to recognize phishing attempts. have implemented cybersecurity frameworks, policies and practices which incorporate industry-standards and contractual requirements.


text: We also contractually flow cybersecurity regulatory requirements to our subcontractors as required by the Defense Federal Acquisition Regulation Supplement and other government agency specific requirements. These contractual flow downs include the requirement that our subcontractors implement certain information security controls. Additionally, we gather information and review the SOC-2 reports of certain third-parties who integrate with our systems, such as our payroll processor, managed solutions provider and software as a service providers on an annual basis to identify and manage risk. We continuously evaluate and seek to improve and mature our cybersecurity processes. We apply lessons learned from our defense and monitoring efforts to help prevent future attacks and utilize data analytics to detect anomalies and search for cyber threats. Additionally, our Internal Audit function regularly assesses our program effectiveness through audits of systems and processes to help maintain compliance with policies.


text: Cybersecurity threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our board of directors has oversight of our strategic and business risk management and oversees management's execution of our cybersecurity risk management program. The board receives regular updates from management on our cybersecurity risks. In addition, management updates the board as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact potential. Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the board, as appropriate.


text: Director of Information Technology leads our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Director of Information Technology manages a team of information technology professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, incident response, insider threats and regulatory compliance. Our Director of Information Technology brings extensive experience in cybersecurity, including conducting DIBCAC (Defense Industrial Base Cybersecurity Assessment Center)


text: audit and overseeing NIST (National Institute of Standards and Technology) internal audits. This expertise ensures our organization aligns with strict industry standards and maintains robust compliance measures.


text: Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration.


text: As of the date of this Annual Report, we believe that we have limited risks associated with a breach in cybersecurity. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (of which we are not aware of any), have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. management and strategy.

companyName: Texas Mineral Resources Corp.

ticker: TMRC


text: We have not established specific processes for assessing, identifying, and managing material risks from cybersecurity threats or engaged third parties to assess such risks. However, if exposed to such a risk, we would assess any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.


text: While we lack a formal risk assessment policy or analysis and no process has been integrated into our management system, a risk assessment would likely include identification of any reasonably foreseeable internal and external risks, any likelihood and potential damage that could result from such risks, and whether existing safeguards are sufficient to manage such risks. If appropriate and necessary, we would implement reasonable safeguards to minimize identified risks and address any identified gaps in existing systems. Board.


text: To date, we have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition..


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, employee personal information, and clinical trial data, or Information Systems and Data.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: We leverage a third party service provider under the direction of our Chief Financial Officer, or CFO, to help management identify, assess and manage our cybersecurity threats and risks. With the assistance of our third-party service provider, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, automated tools for ransomware and virus protection, identity verification tools aimed at ensuring authorized environment access, and ongoing vulnerability assessments.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example data encryption for certain data, network security controls, data segregation for certain data, access controls, physical security controls, monitoring for certain systems, asset management and tracking, and employee training. We also maintain cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are taken into account in our overall risk management processes. For example, we evaluate identified material risks from cybersecurity threats against our overall business objectives and will report material risks, if identified, to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist management to identify, assess, and manage material risks from cybersecurity threats, including for example, a managed security provider and professional services firms, including outside legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, including, for example, application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We have certain vendor management processes to help manage cybersecurity risks associated with our use of certain of these providers, and, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, those processes may involve different levels of assessment and risk mitigation measures, including, for example, the imposition of contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the sections titled "Risk Factors—Risks Related to our Business and Operations—If our telecommunications or information technology systems, or those used by our collaborators, CROs, CMOs, clinical sites, third-party logistics providers, distributors, or other contractors, consultants, or third party service providers upon which we rely, are or were compromised, become unavailable, or suffer security breaches, loss, or leakage of data or other disruptions, we could suffer adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences." and "Risk Factors—Risks Related to Government Regulations—Actual or perceived failures to comply with applicable data protection, privacy and security laws, regulations, standards, and other requirements could adversely affect our business, results of operations, and financial condition."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our CFO, leveraging the expertise of our third party service provider. Our CFO has two years of oversight responsibilities for cybersecurity elements and has been involved in the oversight of the implementation of the Company's current cybersecurity measures.


text: Currently, our CFO is responsible for hiring appropriate personnel, managing external third-party providers, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including to our CFO. As part of those processes, members of management, including our CFO, would work to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes are designed to report certain cybersecurity incidents to the audit committee of the board of directors.


text: The audit committee receives periodic reports from management concerning our cybersecurity risks and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Senior Director, Information Technology, in conjunction with a third party service provider, under the direction of our Chief Financial Officer, or CFO, help management identify, assess and manage our cybersecurity threats and risks. With the assistance of our Senior Director, Information Technology and third-party service provider, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, automated tools for ransomware and virus protection, identity verification tools aimed at ensuring authorized environment access, and ongoing vulnerability assessments.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: data encryption for certain data, network security controls, data segregation for certain data, access controls, physical security controls, monitoring for certain systems, asset management and tracking, and employee training. We also maintain cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are taken into account in our overall risk management processes. For example, we evaluate certain identified material risks from cybersecurity threats against our overall business objectives and will report material risks, if identified, to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the sections titled: "Risk Factors—Risks Related to our Business and Operations—If our telecommunications or information technology systems, or those used by our collaborators, CROs, CMOs, clinical sites, third-party logistics providers, distributors, or other contractors, consultants, or third party service providers upon which we rely, are or were compromised, become unavailable, or suffer security breaches, loss, or leakage of data or other disruptions, we could suffer adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences." and "Risk Factors—Risks Related to Government Regulations—We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Actual or perceived failures to comply with applicable data protection, privacy and security laws, regulations, standards, and other requirements could adversely affect our business, results of operations, and financial condition."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our CFO, leveraging the expertise of our Senior Director, Information Technology and third party service provider. Our CFO has three years of oversight responsibilities for cybersecurity elements and has been involved in the oversight of the implementation of the Company's current cybersecurity measures. Our Senior Director, Information Technology has approximately 20 years of oversight responsibilities for cybersecurity elements and has been involved in the oversight of the implementation of the Company's current cybersecurity measures.


text: Currently, our CFO and Senior Director, Information Technology are collectively responsible for hiring appropriate personnel, managing external third-party providers, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including to our CFO. Senior Director, Information Technology, and General Counsel. As part of those processes, members of management, including our Senior Director, Information Technology and CFO, would work to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes are designed to report certain cybersecurity incidents to the audit committee of the board of directors.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. These policies are found within our Compliance Manual and are the chapters "Cybersecurity, Privacy Protection, and the Prevention of Identity Theft" and "Business Continuity and Succession Planning" (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy is available upon request.

companyName: X1 Capital Inc.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this Annual Report on Form 10-K under the heading "Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, results of operations or financial condition."


text: The Board of Directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which is currently James Hickey, regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents potentially impacting the Company. The CCO is responsible for assessing and managing material risks from cybersecurity threats that may impact the Company.


text: The Company and the broader financial services industry face an increasingly complex and evolving threat environment.

companyName: North Haven Net REIT


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting Morgan Stanley ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Adviser manages the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and shareholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to Morgan Stanley and the Company, to further inform the design of the Cybersecurity Program. To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to Morgan Stanley and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to Morgan Stanley or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity programs to identify the impact of their services on the cybersecurity risks to Morgan Stanley or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or an audit by Morgan Stanley of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.