text: Cyber Risk Management Personnel. Through training and compliance programs, the concept that all employees are responsible for the data and critical systems they access is reinforced. The information technology department for the Company has the responsibility to implement cybersecurity controls under the overall guidance of the cybersecurity team. This cybersecurity team includes internal cybersecurity experts that have a combined 55 years of general information technology experience and 37 years of cyber specific related experience. The internal cyber team have obtained various degrees and certificates in network administration, security administration and information system management. The Company also partners with a third-party cybersecurity firm that assists the Company and many other clients in setting direction, implementing cybersecurity technology and supporting the Company's security operations center. The information technology department is led by two directors, one with over 20 years experience in information technology leadership roles at Knife River and the other with 14 years of combined experience in information technology roles at MDU Resources and Knife River. The information technology department, including the cybersecurity team, reports to the vice president of support services, who has 17 years of information technology leadership and operational leadership experience with Knife River and over 30 years of total information technology experience. The vice president of support services reports to the chief executive officer.


text: Cyber Risk Oversight Committee. Additionally, the Company established CyROC to provide executive management and the audit committee with analyses, appraisals, recommendations, and pertinent information concerning cyber defense of the Company's electronic information, information technology and operation technology systems. The CyROC is responsible for guiding the Company's comprehensive cybersecurity policies. The CyROC is chaired by the Company's supervisor of cybersecurity and is comprised of members from financial and operations management, as well as technology leaders.

companyName: Knife River Corp

ticker: KNF

secItem: Item 1C


text: Risk Management and Strategy Overall Risk Management. We have implemented a cyber risk management program to help ensure that our electronic information and information systems are protected from various threats and are built on and follow the Cybersecurity Maturity Model Certification for information security requirements and the protection of sensitive information. The cyber risk management program is maintained as part of our overall governance, enterprise risk management program and compliance program. Our information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach our cyber-defenses. We also have cyber event related insurance. We are continuously reevaluating the need to upgrade and/or replace systems and network infrastructure. These upgrades and/or replacements could adversely impact operations by imposing increased expenses, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect our company. We continually assess risks from cybersecurity threats and adapt and enhance our controls accordingly.


text: Although risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication.


text: Employee Cybersecurity Training. We provide ongoing cybersecurity training and compliance programs to facilitate education for employees who may have access to our data and critical systems. Employee phishing tests are conducted on a monthly basis.


text: Engage Third-parties on Risk Management. Periodic external reviews, including penetration tests and security framework assessments, are conducted by auditors, external assessors, and/or consultants to assess and ensure compliance with our information security programs and practices. Internal and external auditors assess our information technology general controls on an annual basis.


text: Oversee Third-party Risk. We monitor risks associated with our vendors, which include processes such as completing due diligence on third party service providers before engaging with them for their services; assessing the third party's cybersecurity posture by reviewing audit reports of the third party, completing cyber questionnaires, and reviewing applicable certification; including cybersecurity contractual language in contracts to limit risk; and monitoring and reassessing third party's to ensure ongoing compliance with their cybersecurity obligations.


text: Other Risk Factors. See the risk factor "Technology disruptions or cyberattacks could adversely impact operations" in the section entitled "Item 1A. Risk Factors - Operations, Growth and Competitive Risks."


text: The board, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of our company is responsible for oversight of risks from cybersecurity threats.


text: Management's Role Managing Risk. The vice president of support services plays a large role in informing the audit committee on cybersecurity risks. The audit committee receives presentations and reports from the vice president of support services on cybersecurity related issues which include information security, technology risks and risk mitigation programs regularly at the quarterly board meetings. In addition to scheduled meetings, the vice president of support services and audit committee maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.


text: Cybersecurity Incident Response. We have an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents that is also tested on an annual basis. The incident response plan is updated based on results of the test or as new cyber related developments occur. The incident response plan indicates the vice president of support services, executive leadership which includes the chief executive officer, chief financial officer, chief accounting officer, chief legal officer, corporate controller and the board of directors are to be notified of any material cybersecurity incidents through a defined escalation process. The defined escalation process is a risk-based process that specifies who is to be contacted and when at each risk level.


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks. Our vice president of support services, along with the supervisor of cybersecurity, a designated security team of professionals and third-party cybersecurity experts are responsible for monitoring, assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats we face. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.


text: Cyber Risk Management Personnel. Through training and compliance programs, the concept that all employees are responsible for the data and critical systems they access is reinforced. The information technology department has the responsibility to implement cybersecurity controls under the overall guidance of the cybersecurity team. This cybersecurity team includes internal cybersecurity experts that have a combined 28 years of general information technology experience and 18 years of cyber specific related experience. The internal cyber team members have obtained various degrees and certificates in network administration, security administration and information system management. We also partner with a third-party cybersecurity firm that assists us and many other clients in setting direction, implementing cybersecurity technology and supporting our security operations center. Our internal information technology department is led by two directors, one with 25 years of experience in information technology leadership roles at Knife River and the other with 15 years of experience in information technology roles at MDU Resources and Knife River combined. The information technology department, including the cybersecurity team, reports to the vice president of support services, who has 18 years of information technology leadership and operational leadership experience with Knife River and over 30 years of total information technology experience. The vice president of support services reports to the chief executive officer.


text: Cyber Risk Oversight Committee. Additionally, we established CyROC to provide executive management and the audit committee with analyses, appraisals, recommendations, and pertinent information concerning cyber defense of our electronic information, information technology and operation technology systems. The CyROC is responsible for guiding our comprehensive cybersecurity policies. The CyROC is chaired by our supervisor of cybersecurity and is comprised of members from financial and operations management, as well as technology leaders.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, data related to our clinical trials and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: ACELYRIN, Inc.


text: Our information security function, which is led by our IT department, helps to identify, assess and manage the Company's cybersecurity threats and risks. Our IT team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, manual and automated tools, analyzing reports of threats and threat actors, conducting internal and external scans of our environment, periodic penetration tests conducted by third parties, utilization of a 24x7 security operations center (SOC) that provides monitoring and alert services, evaluating threats reported to us, and coordinating cross-functionally, with Company management and externally (e.g., with law enforcement) concerning threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a Cybersecurity Incident Response Policy; various other policies, plans, and frameworks in regards to (without limitations) access, acceptable use, password security and software system development; physical and administrative access and network security controls; data segregation; encryption of certain data; leveraging of certain SOC II-certified vendors; management, tracking and disposal of certain assets; systems monitoring; participating in information sharing and analysis centers (ISACs) to share and receive threat intelligence specifically related to biopharma and healthcare companies; and maintaining cyber insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. The Company has an IT Steering Committee made up of cross-disciplinary senior management, including (among others) the Chief Legal and Administrative Officer, Chief Financial Officer and Chief Operating Officer, along with IT leadership and representatives from several additional departments. For example, the IT department works with the IT Steering Committee and other senior management personnel to prioritize certain risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, outside consultants, third party penetration testing providers, and threat intelligence and forensic providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as email and hosting providers, contract research organizations (CROs) and contract manufacturing organizations (CMOs). We have certain vendor management processes that we may use as appropriate to manage cybersecurity risks associated with our use of these providers. These processes may include the imposition of information security contractual obligations on vendors, as well as quality control elements for certain vendors. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our internal information technology systems, or those used by our CROs, CMOs, clinical sites or other contractors or consultants upon which we rely, or our data are or were compromised, become unavailable or suffer security breaches, loss or leakage of data or other disruptions, we could suffer material adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, led by our Executive Director of IT & Cybersecurity, who has over 20 years' of work experience in IT and cybersecurity.


text: The Executive Director of IT & Cybersecurity is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Executive Director of IT & Cybersecurity, together with certain other senior management personnel, is responsible for approving functional budgets, implementing approved, phase-appropriate policies, plans and guidelines, helping prepare for potential cybersecurity incidents, reviewing security assessments and other security-related reports and overseeing cybersecurity processes.


text: Our Cybersecurity Incident Response Policy is designed to escalate certain cybersecurity incidents to members of senior management depending on the circumstances, including our Disclosure Committee, as appropriate. Senior management works with the Company's cybersecurity incident management team to help the Company mitigate and remediate notified cybersecurity incidents, comply with applicable laws, regulations and contractual provisions and engage advisors as appropriate. In addition, such policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the Executive Director of IT & Cybersecurity concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to advisors, and various other reports, and presentation materials related to cybersecurity threats, risk and mitigation.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. We have an IT Steering Committee ("ITSC") made up of cross-disciplinary senior management, including (among others) the Head of IT, Chief Legal Officer, Chief Technical Operations Officer and Chief Commercial Officer, along with IT leadership and representatives from several additional departments. The ITSC meets at least quarterly to oversee our IT risk management framework, including information security, data privacy, and regulatory compliance. It monitors the effectiveness of controls, reviews incident reports and provides guidance on mitigating emerging IT risks and vulnerabilities that are more likely to lead to a material impact to our business. The ITSC investigates incidents and reports its findings to our senior management, which, depending on the severity of the incident, may be reported to our audit committee or board.


text: Our information security function, which is led by our Head of IT with the support of our IT department, helps to identify, assess and manage our cybersecurity threats and risks. Our IT team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual and automated tools, analyzing reports of threats and threat actors, conducting internal and external scans of our environment, periodic penetration tests conducted by third parties, utilization of a 24x7 security operations center ("SOC") that provides monitoring and alert services, evaluating threats reported to us, and coordinating cross-functionally, with management and externally (e.g., with law enforcement) concerning threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a Cybersecurity Incident Response Policy; various other policies, plans, and frameworks in regards to (without limitations) access, acceptable use, password security and software system development; physical and administrative access and network security controls; data segregation; encryption of certain data; leveraging of certain SOC II-certified vendors; management, tracking and disposal of certain assets; systems monitoring; participating in information sharing and analysis centers to share and receive threat intelligence specifically related to biopharma and healthcare companies; and maintaining cyber insurance.


text: Our Head of IT has served in various roles in information technology for over 22 years, including serving in cybersecurity focused roles for the past 9 years. Our Head of IT holds an undergraduate degree in Computer Information Systems. Our Chief Legal Officer, Chief Technical Operations Officer and Chief Commercial Officer each hold undergraduate and graduate degrees in their respective fields, and each have substantial experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: The Head of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT, together with certain other senior management personnel, is responsible for approving functional budgets, implementing approved, phase-appropriate policies, plans and guidelines, helping prepare for potential cybersecurity incidents, reviewing security assessments and other security-related reports and overseeing cybersecurity processes.


text: We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, outside consultants, third party penetration testing providers, and threat intelligence and forensic providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as email and hosting providers, CROs and CMOs. We have certain vendor management processes that we may use as appropriate to manage cybersecurity risks associated with our use of these providers. These processes may include the imposition of information security contractual obligations on vendors, as well as quality control elements for certain vendors. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity and information technology risk management, risk assessment and major risk exposures. The audit committee receives periodic reports from the ITSC and our Head of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to advisors, and various other reports, and presentation materials related to cybersecurity threats, risk and mitigation.


text: Our Cybersecurity Incident Response Policy is designed to escalate certain cybersecurity incidents to members of senior management depending on the circumstances, including our disclosure committee, as appropriate. Senior management works with the Company's cybersecurity incident management team to help the Company mitigate and remediate notified cybersecurity incidents, comply with applicable laws, regulations and contractual provisions and engage advisors as appropriate. In addition, such policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our internal information technology systems, or those used by our CROs, CMOs, clinical sites or other contractors, consultants and service providers upon which we rely, or our data are or were compromised, become unavailable or suffer security breaches, loss or leakage of data or other disruptions, we could suffer material adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences."


text: Program and Strategy Our cybersecurity risk management program (the "Cybersecurity Risk Management Program") was designed to identify, manage, mitigate, and respond to ongoing cybersecurity threats and associated risks and is responsible for their escalation to the Board of Directors when determined to be material. Currently, the Cybersecurity Risk Management Program includes cybersecurity services provided by our Former Parent through 2024 as part a transition service agreement entered in connection with the Spin. The underlying controls utilized by these programs are based on industry recognized best practices and standards for cybersecurity and information technology which include the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001:2022 Information Security Management Systems Requirements The Cybersecurity Risk Management Program is administered through two primary channels: (i) Fortrea led cybersecurity services and capabilities, and (ii) trusted third-party partners delivering cybersecurity services overseen by our Cybersecurity leadership team. Both channels combined deliver the entire Cybersecurity Program, which includes key items such as:

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: Cybersecurity risk management program, including, but not limited to, the following: • Risk assessment activities/analyses • Risk Committee oversight, documentation, escalation • Reporting of risk issues deemed material to our Audit Committee of the Board of Directors Cybersecurity services, including, but not limited to, the following: •24x7 Security services and Operations across (3) countries, including an Incident Response Plan and process.


text: • Identity Access Management support and governance • Security Architecture oversight and guidance • Governance, Risk and Compliance ("GRC") functions such as third-party risk management, cybersecurity policies, training, and awareness • Annual and independent penetration testing and vulnerability scanning activities conducted by trusted third parties • Transition services provided by our Former Parent, as part of the Spin, effective June 2023 and through the exit of the transition service agreement Third party risk management, including, but not limited to, the following: • Periodic third party reviews and assessments measuring cybersecurity services capability and maturity.


text: Cybersecurity risks are identified and documented by our cybersecurity team leadership, presented, and reviewed with the Fortrea Cybersecurity Risk Management Committee (the "Risk Committee") as noted in the Governance of Cybersecurity section below. The Risk Committee, in conjunction with business stakeholders as required, evaluates risks which are presented to them to determine materiality. Cybersecurity risks deemed material are then formally agreed upon as items to be reported by the Chief Information Security Officer ("CISO") to the Audit Committee.


text: Recognizing the cybersecurity and risk management programs are newly formed, we have established plans to conduct regular reviews and tabletop exercises to test processes for preparedness in case of a critical event as well as integrate cybersecurity risk with the Enterprise Risk Management Framework. As part of our risk management strategy, we have secured comprehensive cyber insurance coverage. We regularly review and update our cyber insurance coverage to align with the evolving nature of cyber threats and industry standards.


text: Because we are a newly formed company, there are no historical internal or external assessment processes. Going forward, however, the Fortrea Internal Audit team will conduct internal assurance reviews as part of their 2024 annual audit plan. Additionally, as we continue to execute our risk management processes, we plan to engage external cybersecurity partners for the evaluation and assessment of our cybersecurity program and its capabilities.


text: Although unknown cybersecurity risks could materialize as a result of risk factors identified during the Spin, we are not aware of any disclosures at this time which would be considered material risks and associated with cybersecurity threats or incidents. Refer to "Item 1A. Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks.


text: The Fortrea Audit Committee has been authorized by the Board of Directors to oversee risks from cybersecurity threats. We have established a Risk Committee chaired by the CISO and chartered to determine and execute the processes for the identification, and management of material cybersecurity risks. The Risk Committee is comprised of cross-functional executive leaders who can assess materiality impact and are accountable for materiality disclosure. The CISO is responsible for reporting on the state of cybersecurity to the Audit Committee on a quarterly basis, including those risks deemed material by the Risk Committee.


text: Our CISO has more than 25 years of experience building and leading cybersecurity programs for global healthcare and retail companies. The cybersecurity leadership team reporting to the CISO is comprised of leaders with skills in cybersecurity risk management, cybersecurity architecture, identity and access management, and cybersecurity operations and engineering. Their experience and certifications are commensurate with their roles.


text: Program and Strategy Our cybersecurity risk management program (the "Cybersecurity Risk Management Program") was designed to identify, manage, mitigate, and respond to ongoing cybersecurity threats and associated risks and is responsible for their escalation to the Board of Directors when determined to be material. The underlying controls utilized by these programs are based on industry recognized best practices and standards for cybersecurity and information technology which include the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001:2022 Information Security Management Systems Requirements.


text: The Cybersecurity Risk Management Program is administered through two primary channels: (i) Fortrea led cybersecurity services and capabilities, and (ii) trusted third-party partners delivering cybersecurity services overseen by our Cybersecurity leadership team. Both channels combined deliver the entire Cybersecurity Program, which includes key items such as:


text: Cybersecurity risk management program, including, but not limited to, the following: • Risk assessment activities/analyses • Risk Committee oversight, documentation, escalation • Reporting of risk issues deemed material to our Audit Committee of the Board of Directors Global Cybersecurity services, including, but not limited to, the following:


text: •24x7 Security Operations and Incident Response • Identity Access Management support and governance • Security Architecture oversight and guidance • Governance, Risk and Compliance ("GRC") functions such as third-party risk management, cybersecurity policies, training, and awareness • Annual and independent penetration testing and vulnerability scanning activities conducted by trusted third parties Third party risk management, including, but not limited to, the following: • Periodic third-party reviews and assessments measuring cybersecurity services capability and maturity.


text: We have established plans to conduct periodic reviews and tabletop exercises to test various processes for preparedness in the event of a critical cybersecurity incident as well as include cybersecurity risk within our Enterprise Risk Management Framework. As part of our overall risk management strategy, we have secured comprehensive cyber insurance coverage. We regularly review and update our cybersecurity insurance coverage to align with the evolving nature of cyber threats and industry standards.


text: Fortrea will continue to leverage our internal audit department to provide independent reviews and recommendations to enhance Fortrea's ability to manage risks effectively, as well as pursue external certifications. Although unknown cybersecurity risks could materialize, including in connection with the implementation of independent systems following the Spin, we are not aware of any disclosures at this time which would be considered material risks and associated with cybersecurity threats or incidents. Refer to Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks.


text: The Fortrea Audit Committee has been authorized by the Board of Directors to oversee risks from cybersecurity threats. We have established a Risk Committee chaired by the CISO and chartered to determine and execute the processes for the identification and management of material cybersecurity risks. The Risk Committee is comprised of cross-functional executive leaders who can assess materiality impact and are accountable for materiality disclosure. The CISO is responsible for reporting on the state of cybersecurity to the Audit Committee on a quarterly basis, including those risks deemed material by the Risk Committee.


text: Our operations are highly dependent on the information systems and technology of Fortress, the indirect affiliate of our Adviser, which has implemented a cybersecurity management program. Below are details Fortress has provided to us regarding its cybersecurity program that are relevant to us. The Company uses Fortress's cybersecurity program to assess, identify and mange material cybersecurity risks affecting the Company and its operations.

companyName: Fortress Net Lease REIT


text: Processes and Risk Assessment Fortress's cybersecurity program is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: Fortress has implemented an information security governance policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Fortress's cybersecurity program is managed by Fortress's Chief Information Security Officer and Fortress's Chief Technology Officer (together, "Fortress IT Management"), who report to Fortress's Chief Financial Officer. Fortress IT Management and their team are responsible for implementing Fortress's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.


text: These processes and systems are designed to protect against unauthorized access of information, including by cyber- attacks, and Fortress's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Fortress's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Fortress's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.


text: Fortress's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Fortress's deployment of cybersecurity best practices and industry frameworks and help to identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Fortress IT Management for remediation. When Fortress engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Fortress also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Fortress conducts regular phishing tests and provides additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks Fortress has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Fortress's Enterprise Security Steering Committee (the "ESSC"), a cross- functional management committee that includes its General Counsel, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Chief Human Resources Officer and Fortress IT Management. The ESSC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Fortress's cybersecurity program, which is overseen by the ESSC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Fortress's Chief Technology Officer, who has over 30 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Fortress's Chief Information Security Officer, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The ESSC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Fortress's cybersecurity program.


text: The Company's board of trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to an audit committee of the board of trustees (the "Audit Committee"). The Company's CFO periodically reports to the Audit Committee as well as the full board of trustees as appropriate, on cybersecurity matters. Such reporting includes updates on Fortress's cybersecurity program, the external threat environment and Fortress's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Fortress's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks We are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Our business and operations could suffer in the event of system failures or cybersecurity breaches."


text: The Company maintains comprehensive policies, procedures, and controls to protect the Company's information systems and related data from cybersecurity threats and incidents. The Company's cybersecurity risk management program is aligned with the International Standards Organization (ISO 27001:2022) and mapped to National Institute of Standards Special Publication 800-53 Revision 5 (NIST 800-53). The Company's cybersecurity program is integrated into the Company's overarching enterprise risk management program.

companyName: Vestis Corp

ticker: VSTS


text: The Company's Chief Information Security Officer (CISO) is responsible for managing the Company's cybersecurity program and reporting on cybersecurity matters to management, the Cyber Governance Committee, and the Company's board of directors. The CISO has over twenty years of cybersecurity and technology experience, originating with cryptography and security experience as a military officer and progressing through senior management roles at prominent global audit and technology consulting corporations. The CISO leads the Company's cybersecurity and information technology compliance department which is staffed with technical and compliance personnel with the appropriate experience and certifications required to accomplish the department's mandates. The CISO is supervised by the Company's Chief Technology Officer.


text: The Company's maintains a Cyber Governance Committee, which meets quarterly, and interfaces with other functional areas within the Company, including, but not limited to, legal, internal audit, accounting, risk management, human resources, as well as external third-party partners. The CISO serves as the chair of the committee, which has been tasked with providing governance and oversight of the Information Security and Management System and to provide governance during major cybersecurity incidents.


text: The Company engages third parties to assist with the monitoring components of the security infrastructure that we have deployed. As required, the Company engages consultants and third parties to assist with penetration testing, tabletop incident response exercises, or other activities necessary to comply with various standards and certifications that we require to operate as a business. The Company provides regular awareness training to our employees and consultants using our collaboration platforms, including periodic phishing tests, to help identify, avoid, and mitigate cybersecurity threats, as well as targeted security training for key departments dealing with sensitive data types. Where needed, the Company seeks appropriate certifications from vendors and contractually requires adherence to data privacy and security requirements from its vendors. Where service providers are materially utilized, the company obtains SOC1 or SOC2 reports and complies with complementary user entity controls to keep those attestations valid.


text: The Company operates technologies that are exposed to the internet, and although robust cybersecurity programs, technologies, and safeguards are deployed to help protect the Company's operations and assets, the Company by nature is exposed to material cybersecurity attacks that are either generally targeted at companies that operate on the internet, or the Company by nature remains exposed to attacks that are specifically directed at the Company's technology systems exposed to the internet.


text: The Company's Board of Directors provide ultimate oversight of the Company's cybersecurity risk management program. As reflected in the Audit Committee's charter, the Board of Directors has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The CISO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats.


text: During the normal course of business, the Company has experienced and expects to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition or results of operations. The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors."


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents.

companyName: Veralto Corp

ticker: VLTO


text: The Company's cybersecurity program and policies articulate the expectations and requirements with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, vendor due diligence, security (with respect to physical assets, products, networks, and systems), security monitoring and vulnerability identification. The cybersecurity program and policies are operated by a dedicated cybersecurity operations team. The program and policies are aligned with the Company's enterprise risk management program.


text: The Company's cyber risk management program identifies, tracks, escalates, remediates, and reports risks at the corporate level and across each operating company. These risk areas include internal, product, vendor, supply chain, and external services leveraged across the Company. These risks are assessed, prioritized, and both tactically and strategically addressed via process, technology, and personnel improvements to ensure ongoing mitigation and tracking.


text: The Company's cybersecurity strategy is guided by prioritized risk, identified areas for improvement based on the National Institute for Standards and Technology (NIST) Cybersecurity Framework, and emerging business needs. This strategy is shared with the executive leadership at least annually. The Company maintains a global incident response plan, coupled with a global continuous monitoring program. This plan and program include incident alerting, comprehensive incident criticality assessments, and escalation processes to support teams, senior leadership, and the Board. This escalation process also includes cross-functional materiality determinations and applicable reporting requirements.


text: The Company's cybersecurity operations team manages all facets of the security monitoring and global incident program, coordinating with a sourced managed services security provider and internal analysts across our operating companies. Applicable company employees are provided cybersecurity awareness training, which includes topics on the Company's policies and procedures for reporting potential incidents. The Company's cybersecurity team is continuously evaluating emerging risks, regulations, and compliance matters and updating the policies and procedures accordingly.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. The Company does not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which it is aware are reasonably likely to materially affect the Company. Refer to the risk factor captioned "Significant disruptions in, or breaches in security of, our information technology systems or data or violation of data privacy laws can adversely affect our business and financial statements" in Part I, "Item 1A. Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The Board oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. Pursuant to the Audit Committee Charter, the Audit Committee of the Board provides compliance oversight to the Company's risk assessment and risk management policies, which includes cybersecurity, and the steps management has taken to monitor and mitigate such exposures and risks.


text: The Company's Chief Information Security Officer (CISO), in coordination with Chief Information Officer, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 25 years of experience in information security and is a Certified Information Systems Security Professional (CISSP). The CISO reports to the Board, the Audit Committee and management on cybersecurity risk assessment, policies, incident prevention, detection, mitigation, and remediation of cybersecurity incidents on a quarterly or as needed basis.


text: The Company's cyber risk management program identifies, tracks, escalates, remediates, and reports risks at the corporate level and across each operating company. These risk areas include internal, product, vendor, supply chain, and external services leveraged across the Company. These risks are assessed, prioritized, and both tactically and strategically addressed via process, technology, and personnel improvements to help ensure ongoing mitigation and tracking.


text: The Company's Chief Information Security Officer (CISO), in coordination with Chief Information Officer, is responsible for leading the assessment and management of cybersecurity risks and receives reports regarding the prevention, detection, mitigation and remediation of cybersecurity incidents from the Company's cybersecurity operations team. The current CISO has over 25 years of experience in information security and is a Certified Information Systems Security Professional (CISSP). The CISO reports to the Board, the Audit Committee and management on cybersecurity risk assessment, policies, incident prevention, detection, mitigation, and remediation of cybersecurity incidents on a quarterly or as needed basis.


text: As part of our overall risk management system and processes, we assess, identify and manage material risks from cybersecurity threats through our Enterprise Risk Management (ERM) process. For a description of cybersecurity risks relevant to our business, see Item 1A, "Risk Factors."

companyName: PHINIA INC.

ticker: PHIN


text: The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information we collect and store for use in operating our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, suppliers, other business partners and employees; and (v) providing appropriate disclosure of cybersecurity risks and incidents when required. Our cybersecurity and data protection policies, processes and strategies are informed by regulatory and business requirements, our prior experience addressing cybersecurity attacks and incidents (including with our former affiliates) and industry practices, and are periodically adjusted based on the results of assessments conducted through our ERM practices, third-party audits and independent reviews, and other processes.


text: Consistent with the Company's ERM practices, our cybersecurity policies, processes and layers of defense focus on the following areas: • Vigilance. The Company maintains 24/7 cybersecurity threat surveillance in conjunction with a managed security service that monitors system logs and network traffic for indicators of compromise and other suspicious activity, and conducts monthly external vulnerability assessments and annual penetration testing. • System Safeguards. The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including early detection and response antivirus tools, data leak prevention tools and systems, vulnerability scans of data centers, firewalls, and anti-malware functionality and access controls. • Third-Party Collaboration. The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management. The Company has processes in place for identifying and overseeing cybersecurity risks presented by third-party users of the Company's systems, as well as third-party systems that could adversely impact our business in the event of a cybersecurity incident affecting those systems. • Training. The Company requires personnel to complete training regarding cybersecurity threats and incident reporting procedures, which reinforces the Company's information security policies and processes. We also require new hires to complete training regarding cybersecurity threats and acceptable use of our information systems. • Incident Response Planning. The Company has established and maintains a cybersecurity incident response plan that outlines an organized and timely approach for responding to and handling security incidents affecting the Company's systems or data, as well as taking appropriate action when the source of the intrusion or incident involved data from a third party.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's policies and processes through audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity controls and oversight. Third-party audits and independent reviews of our cybersecurity measures, information security control environment and operating effectiveness are conducted on at least an annual basis to assist us with enhancing, implementing and monitoring our cybersecurity risk management programs.


text: As a global company, we have experienced cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. To date, we have not experienced a cybersecurity incident or attack, or any risk from cybersecurity threats, that has materially affected or is reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.


text: The Board, in coordination with the Audit Committee, oversees the Company's policies with respect to the assessment and management of risks from cybersecurity threats. The Board and Audit Committee receive regular updates regarding cybersecurity risks from the Company's Chief Information Security Officer (CISO) and Chief Information Officer (CIO), including with respect to the assessment and management of such risks and recent developments, trends and the general threat environment.


text: The Company's cybersecurity team, which is led by our CISO, is responsible for overseeing the Company's cybersecurity and data security operations, programs, policies and processes and their general effectiveness. The cybersecurity team, in coordination with other Incident Response Team members, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incident. The Company's Incident Response Team consists of our CISO and other senior leaders from the Company's cybersecurity (composed of information security and technology operations), compliance, legal, financial reporting and other key business and corporate functions. The CISO and other Incident Response Team members monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the incident response plan. The team also informs and coordinates with the Company's Disclosure Committee in timely reporting such incidents, as appropriate and depending on the severity of the incident, to the Strategy Board (consisting of our CEO, Chief Financial Officer (CFO), General Counsel, CIO and other members of management), Audit Committee and Board, and providing updates regarding such incidents until addressed.


text: We have experienced leaders responsible for assessing and managing risks arising from cybersecurity threats. Our CISO reports to the CIO and has served in various roles in information technology and information security for over 28 years, including most recently leading the Information Security Office of BorgWarner Inc. He holds a Bachelor of Science in Physics. The Company's CIO reports to our CEO and has served in various roles in information technology and information security for over 25 years, including most recently as CIO of Gentherm Incorporated. Our CIO holds a Bachelor of Science in Business, with a concentration in Computer Information Systems, and an MBA in Finance and Strategic Management. He is also a Digital Directors Network (DDN) Boardroom Certified Qualified Technology Expert (QTE). In addition, the Company's CEO, CFO and General Counsel each have experience overseeing the management of cybersecurity and other risks similar to those impacting the Company's business.


text: As part of our overall risk management system and processes, we assess, identify and manage material risks from cybersecurity threats through our Enterprise Risk Management (ERM) program. For a description of cybersecurity risks relevant to our business, see Item 1A, "Risk Factors."


text: Consistent with the Company's ERM practices, our cybersecurity policies, processes and layers of defense focus on the following areas: • Surveillance and Monitoring. The Company maintains 24/7 cybersecurity threat surveillance in conjunction with a managed security service that monitors system logs and network traffic for indicators of compromise and other suspicious activity, and conducts monthly external vulnerability assessments and annual penetration testing. • System Safeguards. The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including early detection and response antivirus tools, data leak prevention tools and systems, vulnerability scans of data centers, firewalls, anti-malware functionality and access controls, and programs to support remediation, replacement or isolation of systems that have reached, or are expected to reach, end of security life. • Third-Party Collaboration. The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management. The Company has processes in place for identifying and overseeing cybersecurity risks presented by third-party users of the Company's systems, as well as third-party systems used by the Company. • Training. The Company requires personnel, including new hires, to complete training regarding cybersecurity threats, incident reporting procedures and acceptable use of our information systems. • Incident Response Planning. The Company has established and maintains a cybersecurity incident response plan that outlines an organized and timely approach for responding to and handling security incidents affecting the Company's systems or data, including the intrusions or incidents involving data from a third party.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's policies and processes through audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity controls and oversight. Third-party audits and independent reviews of our cybersecurity measures, information security control environment and operating effectiveness are conducted on at least an annual basis.


text: The Board, in coordination with the Audit Committee, oversees the Company's policies with respect to the assessment and management of risks from cybersecurity threats. The Board receives updates regarding cybersecurity risks primarily in connection with its oversight of the Company's risk management practices. The Audit Committee receives updates regarding cybersecurity risks from the Company's Chief Information Security Officer (CISO) and Chief Information Officer (CIO), including with respect to the assessment and management of such risks and recent developments, trends and the general threat environment, on at least a quarterly basis.


text: The Company's cybersecurity team, which is led by our CISO, oversees the Company's cybersecurity and data security operations, programs, policies and processes and their general effectiveness. The cybersecurity team, in coordination with other Incident Response Team members, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. The Company's Incident Response Team consists of our CISO and other senior leaders from the Company's cybersecurity (composed of information security and technology operations), compliance, legal, financial reporting and other key business and corporate functions. The CISO and other Incident Response Team members monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the incident response plan. The team is also responsible for informing and coordinating with the Company's Disclosure Committee in timely reporting such incidents, as appropriate and depending on the severity of the incident, and facilitating updates to the Strategy Board (consisting of our CEO, Chief Financial Officer (CFO), General Counsel, CIO and other members of management), Audit Committee and Board regarding such incidents until addressed.


text: We have experienced leaders responsible for assessing and managing risks arising from cybersecurity threats. Our CISO reports to the CIO and has served in various roles in information technology and information security for over 29 years, including most recently leading the Information Security Office of BorgWarner Inc. He holds a Bachelor of Science in Physics. The Company's CIO reports to our CEO and has served in various roles in information technology and information security for over 26 years, including CIO of Gentherm Incorporated immediately prior to joining the Company. Our CIO holds a Bachelor of Science in Business, with a concentration in Computer Information Systems, and an MBA in Finance and Strategic Management. He is also a Digital Directors Network (DDN) Boardroom Certified Qualified Technology Expert (QTE). In addition, the Company's CEO, CFO and General Counsel each have experience overseeing the management of cybersecurity and other risks similar to those impacting the Company's business.


text: Sinclair maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and disclosure committee. The program addresses the corporate information technology environment, third-party service providers and customer-facing products and applications.

companyName: Sinclair, Inc.

ticker: SBGI


text: The Company's Chief Information Security Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board, the audit committee and disclosure committee. Our Chief Information Security Officer has over a decade of experience leading cybersecurity oversight, and others on our IT security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. At the management level, our IT security team identifies risks by regularly monitoring alerts, meeting to discuss threat levels, trends, and remediation and immediately informs the Chief Information Security Officer, whom leads the IT security team, upon the occurrence of any material event. The processes used to assess the risk level include preparing a monthly cyber scorecard, regularly collecting data on cybersecurity threats and risk areas and conducting an annual risk assessment. To assure risks are reduced and maintained, we conduct periodic external penetration tests, red team testing, and maturity testing to assess our processes and procedures and the threat landscape. We regularly test defenses by performing simulations and drills at both a technical level (including penetration tests) and by reviewing our operational policies and procedures with third-party experts. We view cybersecurity as a shared responsibility throughout the Company, and we periodically perform simulations and tabletop exercises at technical and management levels and incorporate external resources and advisors as needed. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity online training. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training. We utilize our Internal Audit team to assess the design and operating effectiveness of our internal controls, including those that relate to our IT security environment. Further, we maintain various cyber insurance policies and believe we are adequately covered in the event we experience a cybersecurity breach. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Board oversees Sinclair's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The Company's Chief Information Security Officer briefs the Board on the effectiveness of Sinclair's cyber risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the Board, at least annually, as part of the Company's corporate risk management process.


text: We face a number of cybersecurity risks in connection with our business. We have in the past experienced threats to and breaches of our data and systems, including ransomware, malware and computer virus attacks, including a ransomware attack in October 2021 which had a material adverse impact on our business strategy, results of operations or financial condition to date. For more information about the cybersecurity risks we face and have experienced, see the risk factor entitled "We have experienced a cyber security breach in the past and may be vulnerable to future security breaches, data privacy, and other information technology failures that could have a material adverse effect on our financial performance and operating results and disrupt our operations" within Item 1A- Risk Factors.


text: Sinclair maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and disclosure committee. The program addresses the corporate information technology environment, third-party service providers, and customer-facing products and applications.


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board, the audit committee and disclosure committee. Our CISO has over a decade of experience leading cybersecurity oversight, and others on our IT security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. At the management level, our IT security team identifies risks by regularly monitoring alerts, meeting to discuss threat levels, trends, and remediation, and immediately informing the CISO, whom leads the IT security team, upon the occurrence of any material event. The processes used to assess the risk level includes preparing a monthly cyber scorecard, regularly collecting data on cybersecurity threats and risk areas, and conducting an annual risk assessment. To assure risks are reduced and maintained, we conduct periodic external penetration tests, red team testing, and maturity testing to assess our processes and procedures and the threat landscape. We regularly test defenses by performing simulations and drills at both a technical level (including penetration tests) and by reviewing our operational policies and procedures with third-party experts. We view cybersecurity as a shared responsibility throughout the Company, and we periodically perform simulations and tabletop exercises at technical and management levels and incorporate external resources and advisors as needed. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity online training. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training. We utilize our Internal Audit team to assess the design and operating effectiveness of our internal controls, including those that relate to our IT security environment. Further, we maintain various cyber insurance policies and believe we are adequately covered in the event we experience a cybersecurity breach. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Board oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The CISO briefs the Board on the effectiveness of the Company's cyber risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the Board, at least annually, as part of the Company's corporate risk management process.


text: We face a number of cybersecurity risks in connection with our business. We have in the past experienced threats to and breaches of our data and systems, including ransomware, malware and computer virus attacks, including a ransomware attack in 2021 which had a material adverse impact on our business strategy and results of operations in 2021. For more information about the cybersecurity risks we face and have experienced, see the risk factor entitled " We have experienced a cyber security breach in the past and may be vulnerable to future security breaches, data privacy, and other information technology failures that could have a material adverse effect on our financial performance and operating results and disrupt our operations" within Item 1A- Risk Factors.


text: The Company and the broader financial services industry face an increasingly complex and evolving threat environment.

companyName: North Haven Private Income Fund A LLC


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Adviser and the Administrator manage the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and stockholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley forensics team, which develops and implements technologies designed to help detect these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Where a potential threat is identified in Morgan Stanley's environment or which impacts the Company, Morgan Stanley's incident response team evaluates the potential impact to the Firm and, as relevant, the Company, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department, review external cybersecurity incidents that may be relevant to the Firm and the Company, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular training exercises for its employees and consultants, including those personnel relied upon by the Company.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company's Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Risk, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company. Those processes are periodically tested through tabletop exercises.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally and relies on the CIO, CISO, and Head of Operational Risk to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of Operational Risk has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of Operational Risk report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, the CISO, and the Head of Operational Risk, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2023, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its unitholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and unitholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to the Firm and the Company, to further inform the design of the Cybersecurity Program. To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to the Firm and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company's Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk, ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO/CISO and/or Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and Board, as appropriate. The BOTC has primary responsibility for assisting the Morgan Stanley board in its oversight of significant operational risk exposures of the Firm and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.


text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the Gramm-Leach-Bliley Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the Morgan Stanley board and, in accordance with such board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the Morgan Stanley board on cybersecurity risks and threats and other related matters.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2024, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.