text: Related to Cybersecurity Risks Our board of directors holds overall oversight responsibility for the Company's strategy and risk management processes, including in relation to cybersecurity risks. Our board exercises its oversight function through the audit committee, which oversees the assessment and management of risk exposure across various areas, including cybersecurity. Our audit committee receives regular reports from our Chief Financial Officer on significant cybersecurity matters, including, where appropriate, whether any significant incidents have occurred.

companyName: Markforged Holding Corp


text: Our IT Security Steering Committee, which is led by our Chief Financial Officer, is composed of various members of our organization, including our Chief Human Resources Officer, VP of Software Engineering, and Senior Director of TechOps and Security. The IT Security Steering Committee is involved in oversight of cybersecurity risk. The IT Steering Committee exercises this function through our IT Security Team, which includes our Senior Director of TechOps and Security and our VP of Software Engineering who collectively have over 40 years of experience. The IT Security Team is responsible for the administration of our cyber program and works with various vendors and external providers to test and monitor for vulnerabilities and threats. We also engage our employees in our cybersecurity efforts through a process for employees to complete annual security and awareness training.

secItem: Item 1C


text: Our cybersecurity program is informed by industry standards and includes processes for identification, assessment, and management of cybersecurity risks. With support from external vendors, we conduct internal and external risk assessments to assess our cyber program and develop strategies for the management of cyber risks. We also employ vendors and external partners to monitor for and manage threats, and we engage in testing to identify vulnerabilities and use third-party tools to scan for potential risks.


text: Our IT Security Team is informed about and monitors the prevention, management, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. Our managed security service provider is also tasked with testing, auditing, and monitoring the performance of our cybersecurity processes. We also maintain processes for reviewing and assessing vendor security before new engagements as part of our Vendor Advisory Board's function.


text: We maintain processes to inform and update management and, as needed, the audit committee, about security incidents that may pose a significant risk for the business, as applicable. In accordance with our incident response policies, our IT Security Team and Chief Financial Officer are responsible for establishing incident response teams to manage cybersecurity incidents, should any arise. Although risks from cybersecurity threats have to date not materially affected us, and we do not believe they are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. For more information, please see "Item 1A, Risk Factors."


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Inland and the Sub-Advisor. Inland's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Inland's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Inland has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: Inland's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help our sponsor and Advisor to prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor, and Dealer Manager. Inland's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our Advisor, and Dealer Manager, is integrated into Inland's risk management program. In addition, Inland periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs, including performing penetration testing of Inland's networks, and security assessments of the effectiveness of Inland's information technology environment to identify potential vulnerabilities.


text: Inland's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities as well as regular phishing simulations for all of the employees of the Advisor and its affiliates. Inland undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Advisor, and Dealer Manager, and our critical third-party vendors (including the transfer agent) and other partners.


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Advisor, Dealer Manager and service providers (including the transfer agent), tenants, borrowers, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 19 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Advisor's management, and our Board and Audit Committee, as appropriate.


text: The Sub-Advisor's cybersecurity program provides a structured approach which serves to promote practices, procedures, and methodologies that seek to appropriately mitigate information security risks on behalf of its investment vehicles and its underlying investors. At all times, the Sub-Advisor seeks to proactively identify potential risks to its business and develop policies and procedures to minimize such risks. The Sub-Advisor has implemented data security policies, which include provisions to limit access to sensitive data only to those who require it; to follow a policy of least privilege; and an authorization process for those who otherwise request access to data. The Sub-Advisor has also implemented backup and recovery procedures, with backup occurring on a nightly basis and disaster recovery tests conducted on an annual basis. The Sub-Advisor's internal systems are protected by security measures, including hardening policies, firewalls, and disaster recovery tests. In addition, the Sub-Advisor makes use of encryption standards on its systems and requires multifactor authentication for remote access. The Sub-Advisor ensures company-related data is compartmentalized on its employees' personal mobile devices and ensures that its employees are trained on and subject to appropriate confidentiality obligations. The Sub-Advisor performs security risk assessments on a monthly basis and additionally conducts internal and external penetration tests on an annual basis.


text: The Sub-Advisor has developed a comprehensive incident response plan and established a Cybersecurity Task Force which leads the effort for enhancing data protection practices and is responsible for administering the cybersecurity policy and determining and implementing the appropriate technical and organizational measures within the firm for the safeguarding of sensitive data. The Director of Information Technology at the Sub-Advisor is primarily responsible for assessing cyber risk and bringing risks to the attention of the other members of the Cybersecurity Task Force. The Sub-Advisor has also engaged a third-party to assist with tasks such as planning incident response plans, conducting tabletop exercises, conducting phishing exams, etc.


text: Oversight of Cybersecurity Risks The Board and our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our Board and/or our Audit Committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the Advisor, the Sub-Advisor, and the Dealer Manager and the measures we, the Advisor, the Sub-Advisor and the Dealer Manager are taking to mitigate such risks. In addition to such reports and updates, our Board and/or our Audit Committee receive updates from management as to changes to our and the Advisor's, the Sub-Advisor's and the Dealer Manager's cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow Inland's incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.


text: Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Part I, Item 1A, Risk Factors, Risks Related to an Investment in Our Company" for more information regarding cybersecurity risks.


text: Cybersecurity represents an important component of the Company's overall cross-functional approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks identified for oversight by the Board through our annual ERM assessment. While the Board is ultimately responsible for risk oversight, the Audit Committee oversees the overall review of our policies and procedures with respect to risk assessment and risk management, and has oversight of information technology and security matters, which includes cybersecurity strategies and risks, as well as data privacy and data protection ("Information Security"). The Audit Committee oversees the management of risks from cybersecurity threats, including the policies, processes, and practices that the Company's management implements to address risks from cybersecurity threats.

companyName: Burlington Stores, Inc.

ticker: BURL


text: On a quarterly basis, our Chief Information Officer reports to the Audit Committee on our Information Security program, including presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, security initiatives, vulnerability assessments, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and vendors; recent cybersecurity-related developments; strategic activities; and the execution of our cybersecurity awareness training. In turn, the chair of the Audit Committee reports out to the full Board on a quarterly basis regarding these matters, among other matters addressed by the Audit Committee.


text: Ongoing internal and external cybersecurity assessments are conducted, which include the evaluation of certain tools, procedures, and policies to measure the program's overall maturity based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework and annual compliance with the Payment Card Industry Data Security Standard to protect customer credit card data.


text: Our cybersecurity program includes: • Vigilance: The Company maintains a cybersecurity threat operation that endeavors to detect, contain and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the business. • Partnerships: The Company has established partnerships with a number of third parties, including service providers, to identify and assess cybersecurity risks. • Systems Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls and ongoing vulnerability assessments. • Third-Party Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, such as vendors and service providers. The Company performs due diligence on third parties that have access to our systems, data or facilities that house such systems or data. Additionally, the Company generally requires those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways. • Education: The Company provides periodic awareness training for personnel regarding cybersecurity best practices. Routine security bulletins are sent to personnel throughout the year to enhance awareness of responsibility regarding security risks and we conduct regular phishing exercises. "Security Awareness Month" activities also occur on an annual basis and include sessions with guest speakers, relevant communication, and additional educational opportunities related to security risks. • Incident Response Planning: The Company has established and maintains a written incident response plan that addresses the Company's response to a cybersecurity incident, and such plan is tested periodically with tabletop exercises. • Communication and Coordination: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving senior management personnel from the technology, operations, legal, risk management, internal audit and other key business functions (the "cybersecurity team"), as well as members of the Company's Board and the Audit Committee of the Board. • Insurance: The Company carries information security risk insurance that is designed to mitigate against certain potential losses arising from a cybersecurity incident.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through assessments, tabletop exercises and other exercises focused on evaluating effectiveness, including regular network and endpoint monitoring, vulnerability scanning and penetration testing. The Company also engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Company's Chief Information Officer and Audit Committee, and the Company considers adjustments to its cybersecurity processes and practices as appropriate based on the information provided by the third-party assessments and reviews.


text: The Company's Chief Information Officer, who has many years of relevant experience, with support from the other members of the cybersecurity team, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program. We believe our cybersecurity team has the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: The Company's Chief Information Officer, in coordination with the cybersecurity team, works to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. To facilitate the success of this program, the cybersecurity team addresses cybersecurity threats and responds to cybersecurity incidents in accordance with the Company's written incident response plan. The Chief Information Officer and cybersecurity team regularly meet to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and the Chief Information Officer consults with executive management, including the CEO, to report such incidents to the Audit Committee and the Board and initiate a response to incidents when appropriate.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are likely to materially affect the Company, including its business strategy, results of operations, or financial condition; however, as further discussed in Item 1A, Risk Factors, if we are unable to protect our information systems against service interruption, misappropriation of data, breaches of security, or other cyber-related attacks, our operations could be disrupted, we may suffer financial losses and our reputation may be damaged.


text: To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices.

companyName: AWARE INC /MA/

ticker: AWRE


text: The Company has implemented a Cybersecurity Policy (the "Policy") that provides a framework for responding to cybersecurity incidents. The Policy includes requirements for incident disclosure and reporting, protocols for incident evaluation, including the use of third-party service providers and partners, and processes for notification and internal escalation of information to the Company's senior management, incident response team, and Board of Directors (the "Board") and appropriate Board committees. The Policy also addresses requirements for the Company's external reporting obligations. The Plan is reviewed and updated, as necessary but no less frequently than once a year, under the leadership of the Company's Chief Security Officer ("CSO").


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on the Company's cybersecurity-related risks.


text: The Board of Directors, primarily through its Audit Committee, oversees the Company's cybersecurity program. Management regularly reports to the Audit Committee on the current state of the Company's cybersecurity program, including the current threat landscape, cybersecurity risks, and any significant incidents. The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements that the Audit Committee deems appropriate.


text: At the management level, the Company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported, to the extent required by applicable law.


text: We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information technology ("IT") systems and protect the confidentiality, integrity, and availability of our data.

companyName: FTC Solar, Inc.

ticker: FTCI


text: We have integrated cybersecurity risk management into our overall risk management and internal control framework and have established policies and controls that we believe are appropriate in light of the risks of damage to our reputation and financial condition from unauthorized access to our key digital assets and systems.


text: Many of our key IT systems are provided by third parties with extensive experience and knowledge in addressing cybersecurity risks involving those systems and have their own robust system of controls regarding their software products, which we monitor on a recurring basis through review of independent reports on their systems of internal controls provided to us. Such IT systems include our primary accounting, financial reporting, payroll and employee benefits, document storage, email and video communication and employee expense reporting systems. Our internal intranet and IT asset control systems are also managed on our behalf by a third-party service provider, with whom we participate in regular weekly meetings to discuss cybersecurity-related items such as (i) operating and application system patching, (ii) phishing attempts, (iii) malware, (iv) non-compliant devices, (v) third-party secure scorecard results, and (vi) alerts provided through our Security Operations Center.


text: We obtain security incident reports from our third-party software and service providers regarding unauthorized attempts to access our systems, when and if they occur, and we work closely with our third-party providers to explore the details of any unauthorized attempts to infiltrate those systems and to assess whether any critical information within those systems was compromised or not. We also evaluate to the extent possible our system of controls in comparison to information obtained from our third-party providers, as well as our independent accountants and other technology consultants, of practices followed by other companies in safeguarding their systems in order to ensure our cybersecurity strategies and processes remain at the forefront of industry best practices.


text: Many of our employees work remotely or in various locations around the world and are provided with company-owned IT equipment. Software and firmware updates to such equipment are managed and controlled by the Company.


text: In order to further protect ourselves financially, we maintain insurance coverage of up to $5 million with respect to losses from business interruption, data recovery, cyber-extortion and ransomware, data breach response and crisis management as a result of a cybersecurity incident.


text: As of the date of the filing of this Annual Report, we have not encountered any cybersecurity incidents that have materially impaired our business strategy, operations or financial standing.


text: Our Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and has established oversight mechanisms to ensure effective governance in managing these risks. The Audit Committee is central to the Board's oversight and has been directed to assume primary responsibility for such oversight by the Board. The Audit Committee is comprised of board members with diverse experience including risk management, technology and finance, which, in the judgment of the Board, equips them with the ability to oversee cybersecurity risks effectively. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance to our management and approval of major initiatives.


text: Management's Role Managing Risk We have established a Cybersecurity Governance Committee, which meets monthly or more frequently, if needed, to monitor: • our current cybersecurity controls and our ability to address emerging threats; • the status of our ongoing cybersecurity initiatives and strategy; • incident reports from any cybersecurity events; and • compliance with regulatory requirements and industry standards.


text: Our Cybersecurity Governance Committee includes our Chief Financial Officer, Chief Operating Officer, General Counsel, Senior Director of IT, Director of IT, Senior Director of Software, Corporate Controller, Director of SEC Reporting and Technical Accounting, and Director of Internal Audit. We believe the members of our Cybersecurity Governance Committee have relevant knowledge and experience in either IT systems, auditing of controls over IT systems, or management and assessment of risk processes and internal control systems to ensure proper management oversight.


text: Our IT management is responsible for notifying the Cybersecurity Governance Committee of cyber incidents they become aware of from software alerts, third-party vendors, employees or by other means. The Cybersecurity Governance Committee will review such incidents, including activities by IT management to evaluate the severity of the incidents, and will provide details of any cybersecurity events, including those not deemed to have a material impact, to our Internal Controls and Disclosure Committee for reporting to our Audit Committee. In addition, our Chief Financial Officer, Senior Director of IT and Director of Internal Audit maintain an ongoing dialogue with the Audit Committee during the year regarding emerging or potential cybersecurity risks.


text: The Cybersecurity Governance Committee has the responsibility for determining if a cybersecurity incident is considered to have a material impact on the Company requiring public reporting in accordance with the rules and regulations of the U.S. Securities and Exchange Commission.


text: Under the guidance of the Cybersecurity Governance Company, we have adopted (i) a Security Incident Response Plan, (ii) a Cybersecurity Materiality Assessment Policy, and (iii) a Cybersecurity Register of Events.


text: Our IT management, in conjunction with our Director of Internal Audit, has responsibility for monitoring and testing the effectiveness of our cybersecurity controls and procedures on a recurring basis.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and approved medications ("Information Systems and Data").

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Our information security team, supported by our legal and compliance departments, help identify, assess and manage our cybersecurity threats and risks. Our information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, depending on the context, including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement about certain threats, conducting internal audits and threat assessments, and conducting vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response procedures; disaster recovery/business continuity plans; risk assessments; implementation of security standards; encryption of certain data; network security, access, and physical controls for certain systems; management, tracking and disposal of certain assets; systems monitoring; employee training; penetration tests by third-party service providers; tabletop exercises; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms such as legal counsel, threat intelligence providers, cybersecurity consultants and software providers, and other third-party service providers including for identity management solutions.


text: We use third-party service providers to perform a variety of functions throughout our business application providers, hosting companies, contract research organizations (CROs), contract manufacturing organizations (CMOs), supply chain resources, and other business-related SaaS platforms. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes conducting risk assessments of certain vendors, reviewing certain vendors' security assessments, and reviewing reports of certain of our vendors' security. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our business is subject to complex, stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations relating to privacy and data protection. Our actual or perceived failure to comply with such obligations could result in regulatory investigations or actions, litigations (including class claims) and mass arbitration demands, fines and penalties, disruptions of and changes to our business practices, monetary penalties, reputational harm, loss of revenue or profits, and other adverse business consequences."; and "If our information technology systems, or those used by our CMOs, CROs or other contractors, consultants or third parties upon which we rely, or your data are or were compromised, we could experience adverse consequences, including but not limited to regulatory investigation, actions, litigation, fines and penalties, disruptions of our business operations, reputation harm, loss or revenue or profits, and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Information Technology/Information Security, internal legal counsel, Chief Compliance Officer ("CCO"), and Chief Financial Officer ("CFO"). Our Senior Director of Information Technology/Information Security has over ten years of experience in information technology and security, and previously held positions such as Associate Director of Informational Technology and Operations, Senior Manager of Informational Technology, and similar roles at other companies.


text: Our Senior Director of Information Technology/Information Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. Our CFO is responsible for approving budgets as related to cybersecurity.


text: Our incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Director of Information Technology/Information Security, Data Protection Officer, and the Vice President, Legal. These individuals work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee of the board of directors receives annual reports from our Senior Director of Information Technology/Information Security concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee of the board of directors also receives and has access to various presentations related to cybersecurity threats, risk and mitigation.


text: In the ordinary course of business, CSB relies on electronic communications and information systems to conduct its operations and to store sensitive data. CSB employs an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. CSB employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. CSB Places a high priority and focus on securing the confidential information it receives and stores about its customers and associates and providing highly available systems.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: Our Information Security ("IS") Program consists of policies, procedures and guidelines to ensure the security, availability, and confidentiality of systems and customer information. The IS Program is led by our Information Security Officer ("ISO") under the direction of the Chief Information Officer ("CIO") and is subject to oversight by our IT Steering Committee. The IT Steering Committee is a cross-functional management committee with overall responsibilities for identifying and approving the IT Strategic plan, identifying and approving strategic technology based initiatives that improve/enhance the security posture and mitigation efforts of cybersecurity threats, monitoring of the technology infrastructure and systems, monitoring critical vendors, monitoring cybersecurity threats and issues, and conducting, reviewing, and monitoring IT based risk assessments. These efforts include the framework used to identify and prevent cyberattacks or breaches. The IT Steering Committee makes recommendations for approval of certain risk assessments, risk frameworks, and appropriate application of mitigation strategies and frameworks to the Board of Directors.


text: The Board of Directors oversees the IS Program in the following ways: (a) monitors and oversees the Company's business and information technology operations necessary for its business plan, including projected growth, technology capacity, planning, operational execution, product development and management capacity, (b) reviews the Company's framework(s) to prevent, detect, and respond to cyberattacks or breaches, as well as identifying areas of concern regarding possible vulnerabilities, and reviews policies pertaining to information security and cyber threats, taking into account the potential for external threats, internal threats, and threats arising from transaction and contractual relationships with trusted third party vendors, and (c) reviews the Company's incident response, business continuity and disaster recovery planning and preparedness including processes, policies and procedures that are related to preparing for recovery or continuation of technology infrastructure which are vital to the Company. As part of the Board's oversight, the Board receives frequent reports from the CIO and ISO including the summarization of new and emerging cybersecurity threats and trends and the effectiveness of our IS Program in mitigating cybersecurity threats among other items. In the event of an information security incident, our Incident Response Plan clarifies the steps for escalation according to the severity of the event.


text: The IS team is staffed primarily with internal associates, and we utilize third party service providers for extended coverage. We hire IS team members that have relevant information security experience or technology certifications and knowledge to implement and oversee the procedures and processes of our IS Program and to adequately manage and enforce our policies and procedures. Further, management involved in the cybersecurity process, possess the necessary skills and expertise to adequately manage and enforce our policies and procedures.


text: While all vendors are subject to our vendor management process, those with access to our data and data centers are subject to more rigorous initial and ongoing due diligence. This includes the reviews of Service Organization Control 2 ("SOC 2") reports, financial information, and other policies and procedures related to such third party vendors and their various programs, including vendor management.


text: As part of the ongoing maintenance and development of our IS Program, we assess the various risks associated with the unauthorized access or loss of client information and the quality of security controls as prescribed by the Federal Financial Institutions Examinations Council and several other frameworks. The frameworks and our IS risk assessments are utilized to monitor and develop strategies to minimize risk to our information assets.


text: Our systems are monitored 24/7 for cybersecurity threats, and we utilize a variety of tools to reduce the risk of data breaches and cybersecurity events. We maintain an Incident Response Plan that outlines the steps to be taken in the event of an incident, which could include a potential or actual data breach. The plan identifies a designated team, including associates and third-party experts, responsible for incident response and summarizes the steps, including escalation protocol, for determining whether an event has occurred and the nature and scope of the event (if applicable). The plan also summarizes protocol for notifying impacted persons, which may include customers as well as other applicable agencies or persons, including law enforcement and regulatory authorities.


text: At least annually, we conduct a third-party information security audit focusing on internal and external network security protocols and penetration testing, as well as internally managed ad hoc testing as needed. Simulations and tabletop testing of our business continuity and Incident Response Plans are performed on a routine basis and assist with our associates' familiarity and preparedness for an event. Any gaps or improvement areas identified by routine testing are addressed in a timely manner to help improve future testing and response.


text: The processes and controls related to data security are regularly tested by the IS department and Internal Audit. Additional internal security assessments may be performed at the request of the CISO, CIO, the Internal Auditor, Management or our Board. Audit and assessment results are presented to the Audit Committee of the Board, and to the IT Steering Committee.


text: At least annually, the IS Program, including its effectiveness, is reviewed by the Board. Annually, all associates participate in mandatory training related to the IS Program, including information security and its importance with respect to customer and associate privacy. All associates are required to participate in monthly bank wide phishing tests. Results from these tests are delivered to our Audit Committee of the Board of Directors.


text: Notwithstanding the strength of CSB's defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, CSB has not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, CSB's systems and those of its customers and third-party service providers are under constant threat and it is possible that CSB could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as the expanding use of internet banking, mobile banking and other technology-based products and services by the Company and its customers.


text: The Company's Information Technology team has established an information security management system to safeguard the confidentiality, integrity, and availability of the Company's products, infrastructure, and data. This system is integrated with our Quality and Business Management Systems and, aims to identify, assess, and address cybersecurity risks affecting our business. It features an Incident Response Procedure ("IRP") that specifies roles and responsibilities during security incidents, detailing incident detection, investigation, mitigation, and prompt incident reporting procedures.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: The IT Director leads and coordinates cybersecurity efforts at Aeva, providing regular updates on cybersecurity progress to the senior leadership team. The Information Security team actively shares updates on the status of cybersecurity efforts and risks, evaluates our information security programs, and monitors the evolving threat landscape on a company-wide level.


text: Additionally, we conduct regular internal assessments and audits, complemented by insights from external experts. The outcomes of these evaluations are communicated to senior leadership. Based on these risk assessments, we redesign, implement, and maintain adequate safeguards to reduce identified risks, address gaps, and continuously assess the efficacy of these measures. Our engagement with our key partners, vendors, customers, industry stakeholders, and government bodies is relentless, aiming to improve our information security policies and procedures over time. We aim to diligently manage risks related to cybersecurity threats from third-party service providers, including, when possible, requesting our service providers to report incidents that may compromise the Company's data.


text: Risks from Threats and Incidents Our IT infrastructure, encompassing operational and security systems, integrated software, and data processed by us or our third-party vendors, is vulnerable to cybersecurity threats and incidents. As of December 31, 2023, these risks have not significantly impacted the Company, including our business strategy, or operational results, or financial results.


text: Our Chief Technology Officer is tasked with assessing and managing significant cybersecurity risks across the Company based on the assessments of our IT Director. Our IT Director brings a wealth of IT and Information Security expertise from various roles in the technology industry.


text: The Audit Committee has recently been assigned responsibility for overseeing our cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats and incidents. When incidents occur, depending on the nature and severity, the Audit Committee is notified, and incidents are further reviewed with the Audit Committee. Material cybersecurity matters will be reviewed with the full Board of Directors.


text: Management policies and procedures We recognize the need to protect our data, systems and technology. We have described related risks in Item 1A under the heading "Risks Related to our Technology and Data." We have previously assessed and periodically measure our security maturity using the US National Institute of Standards and Technology Cybersecurity Framework. ("NIST CSF") supported by other internal and third party assessments. Gaps or perceived weaknesses in our NIST CSF score are highlighted to our Cybersecurity Risk Committee and subsequently to the Board of Directors. A reassessment of our maturity using NIST CSF is being carried out in the early part of 2024. These assessments allow us to prioritize investment into those areas which provide the greatest improvement in the CSF scoring and by implication, our ability to identify, protect, detect, respond and recover from information and cybersecurity incidents. Risks are recorded in OneTrust and are formally assessed monthly, considering likelihood and potential impact and mitigating actions are implemented where possible to reduce identified risks. Controls designed to reduce or eliminate risk are designed into our technology, processes and management of third parties. We conduct regular vulnerability scanning and use a third party for regular penetration testing designed to help us identify new weaknesses or vulnerabilities. In addition, we use the same third party to help us conduct cybersecurity incident simulation which is subsequently used to inform updates to our Cybersecurity Incident Response Plan. We also have procedures designed to assess risks related to the use of third-party suppliers.

companyName: Soho House & Co Inc.


text: In the previous 12 months, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. For additional information about the cybersecurity risks we face, see the risk factors entitled, "A cybersecurity attack, 'data breach' or other security incident experienced by us or our third-party service providers may result in negative publicity, claims, investigations and litigation and adversely affect our business, results of operations and financial condition," and "If we fail to properly maintain the confidentiality and integrity of our data, including member and customer credit or debit card and bank account information and other PII, or if we fail to comply with applicable laws, rules, regulations, industry standards and contractual obligations relating to data privacy, protection and security, it may adversely affect our reputation, business and operations," in Item 1A Risk Factors.


text: We have implemented a governance program which facilitates senior management oversight of cybersecurity risk management. An operational risk group comprising senior SHCO Cyber Risk and third party Cyber Risk professionals together with the IT Infrastructure lead meet monthly to review emerging risks, progress with mitigation of identified risk and prioritization of risk reduction activities. The output from this group is shared quarterly with the Cyber Security Risk Committee ("CSRC") a Board Sub-Committee which comprises the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Technology Officer (CTO), Chief Legal Officer (CLO) and Director of Information Security. The CSRC is responsible for reviewing the top strategic cyber risks, progress against cyber maturity improvement and recommending funding and resource requirements. The CSRC reports twice per year to the Audit Committee and the Board. The CSRC is also the body that collectively assess materiality in the event of a cybersecurity incident and meets as required to assess materiality.


text: Management's role and relevant experience in assessing and managing cybersecurity The NIST CSF is used to assess cybersecurity maturity. An initial baseline assessment has been used to inform our Cybersecurity Strategy and periodic assessments are used to update the NIST CSF scoring. These assessments are carried out by an independent third party to provide appropriate objectivity and challenge. In addition, we are progressing towards certification to the international information security management standard - ISO 27001 and the related standard ISO 27701 for privacy information management. Execution of our cybersecurity strategy is overseen by our Director of Information Security who is a qualified CSIM, CISA and a Fellow of the UK Chartered Institute of Information Security and has over 30 years of experience in cyber security. The Director of Information Security provides the CTO with periodic updates and also chairs the Cyber Security Risk Committee which provides a forum for senior management to discuss cyber risk management in greater detail.


text: Cyber Risk Management and Strategy We have a process in place for assessing, identifying, and managing material risks from cybersecurity threats. This process is integrated into the Company's overall risk management framework, as overseen by the Company's Board of Directors.

companyName: CareMax, Inc.


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards & Technology. Our process includes overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company from time to time engages third-party consultants and legal advisors in evaluating and testing the Company's risk management framework and assessing and remediating certain potential cybersecurity incidents as appropriate.


text: For information regarding cybersecurity risks that may materially affect our Company, see "Risk Factors — Risks Related to Our Business and Industry — We are dependent on information technology and our systems and infrastructure face certain risks, including from cybersecurity breaches and data leakage — and — Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our patients or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation." To date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Given the increasing cybersecurity threats in the healthcare industry, there can be no assurance we will not experience business interruptions; data loss, ransom, misappropriation or corruption, theft, or misuse of proprietary data, patient or other personally identifiable information; or litigation, investigation, or regulatory action related to any of those, any of which could have a material adverse effect on our patient care, ability to admit patients and to bill and collect for services provided on a timely basis, financial position, and results of operations and could harm our business reputation. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Related to Cybersecurity Risks Management is responsible for the day-to-day management of cybersecurity risks we face, while our Board of Directors has responsibility for the oversight of risk management. The Audit Committee of our Board of Directors oversees the management of our risks from cybersecurity threats. In addition, the Board of Directors discusses with management our major risk exposures, their potential impact on us, and the steps we take to manage them.


text: Our Vice President of Information Technology is responsible for developing, implementing, and maintaining our cybersecurity risk management policies and procedures. The Vice President of Information Technology has over twenty years of information technology management experience. The Vice President of Information Technology and his team hold regular meetings focused on prevention and detection of cybersecurity threats, business continuity and identity protection.


text: The Vice President of Information Technology reports to our Chief Digital Officer and provides semi-annual cybersecurity updates to the Audit Committee of our Board of Directors. In the event of the detection of an actual or suspected cybersecurity incident, a designated management committee is engaged to investigate the incident, manage response, and report the incident to securities counsel to assist with assessment of materiality. A member of the executive team would inform our Board of Directors as warranted.


text: In an effort to protect our business from cybersecurity threats, we maintain and utilize various tools and processes that are designed to identify, assess, and manage cybersecurity risks. Our cybersecurity risk management program, which is in process of being integrated into our enterprise risk management program, is based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our cybersecurity risk management program focuses on monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents.

companyName: Tango Therapeutics, Inc.

ticker: TNGX


text: There are a number of components of our risk management program. We leverage external third parties for security testing on an annual basis, including penetration testing. We consistently monitor critical risks from cybersecurity threats using automated tools and have a process to implement mitigation plans. Our Security Committee, headed by the Head of IT and Chief Legal Counsel, assess and monitor any identified security incidents that impact us or our external partners. Furthermore, we assess and review the cybersecurity practices of third parties who have access to our systems and/or process our sensitive information. This assessment may involve requesting Systems and Organization Controls Type 2 reports (SOC2 reports), conversations with our Head of IT, and the inclusion of contractual requirements to maintain data protection safeguards and timely notification if the third party experiences a security incident which may have a critical impact on our business or our data. Additionally, we conduct cybersecurity awareness training for employees during onboarding and throughout the year, and we conduct regular phishing simulations in an effort to raise awareness of spoofed or manipulated electronic communications and other cybersecurity threats.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, and we do not believe they are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, we could from time to time, experience threats to and security incidents related to our third-party vendors' information systems. For more information about the cybersecurity risks we face, see the risk factor entitled "We may be unable to adequately protect our information technology systems from cyberattacks, cyber intrusions or otherwise which could result in damage to our information technology systems and unauthorized disclosure or use of confidential or proprietary information, including personal data" in Item 1A- Risk Factors.


text: Our Board of Directors has delegated responsibility for overseeing our policies, practices and assessments with respect to cybersecurity and other information technology risks to the Audit Committee. Our Head of IT, under the supervision of our Chief Financial Officer, is responsible for the establishment and maintenance of our cybersecurity risk management program, including the day-to-day oversight of the assessment and management of cybersecurity risks. The Head of IT will regularly consult with outside security experts and management to evaluate certain aspects of the cybersecurity risk management program. The Head of IT has approximately 15 years of experience in information security and cybersecurity risk management. The IT team also institutes and maintains controls for our systems, applications, and databases.


text: The Head of IT reports on the status of our cybersecurity risk management program to management and our Audit Committee on a periodic basis, which may include a discussion of the results of our annual third party cybersecurity risk assessments and critical updates to our mitigation and remediation efforts.


text: As an externally-managed company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior professionals of our Adviser and our Adviser is a subsidiary of J.P. Morgan. As such, we are reliant on J.P. Morgan for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Cybersecurity risk is an important and continuously evolving focus for us, the Adviser, J.P. Morgan, and its affiliates. Significant resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology. The Adviser's security efforts are designed to protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage.


text: The Adviser, J.P. Morgan, and its affiliates have experienced, and expect to continue to experience, a higher volume and complexity of cyber-attacks against the backdrop of heightened geopolitical tensions. The Adviser leverages J.P. Morgan's Global Technology's Cybersecurity and Technology Control ("CTC") Function, which is responsible for the governance and oversight of J.P. Morgan's cybersecurity program. In partnership with J.P. Morgan's lines of business, the CTC organization identifies information security risk issues and champions programs for the technological protection of J.P. Morgan's information resources, including applications, infrastructure and confidential information related to the firm's clients. J.P. Morgan has implemented measures and controls reasonably designed to address this increased risk, such as enhanced threat monitoring. There can be no assurance that the measures taken by us, the Adviser, J.P. Morgan and its affiliates will be successful in defending against cyber-attacks.


text: The Adviser closely collaborates with J.P. Morgan to understand the full spectrum of cybersecurity risks in the operating environment, enhance defenses and improve resiliency. J.P. Morgan actively participates in discussions and simulations of cybersecurity risks internally and administers ongoing initiatives to educate its employees on cybersecurity risks.


text: Third parties with which we, the Adviser, J.P. Morgan and its affiliates do business or that facilitate our, the Adviser's, J.P. Morgan's, and its affiliates' business activities (e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries) are also sources of cybersecurity risk to us. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises, could affect a third party's ability to deliver a product or service to us or the Adviser, or result in losing or compromising our or our stockholders', clients' and customers' information. Stockholders, clients and customers are also sources of cybersecurity risk to us and our information assets, particularly when their activities and systems are beyond our, the Adviser's, J.P. Morgan's, and its affiliates' security and control systems. However, where cybersecurity incidents occur because of stockholder, client or customer failures to maintain the security of their own systems and processes, they are responsible for losses incurred. J.P. Morgan engages in periodic discussions with external parties concerning cybersecurity risks including opportunities to improve cybersecurity.


text: We believe that risks from cybersecurity incidents have not materially affected or are not reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Organization and Management To help safeguard the confidentiality, integrity and availability of our infrastructure, resources and information, J.P. Morgan maintains an Information Security Program designed to prevent, detect and respond to cyberattacks. In addition, the Adviser leverages J.P. Morgan's cybersecurity incident response plan ("IRP"), which is designed to enable us, the Adviser and its affiliates to respond to attempted cybersecurity incidents, coordinate such responses with law enforcement and other government agencies, and notify stockholders, clients, and customers, as applicable.


text: The Global Chief Information Security Officer ("CISO") is responsible for J.P. Morgan's Information Security Program, which includes managing its global cybersecurity operations centers, providing training, conducting cybersecurity event simulation exercises, overseeing its policies and standards relating to information technology risk and security management, and enhancing, as needed, its information security capabilities. The CISO reports to the Global Chief Information Officer and is a member of key cybersecurity governance forums. The CISO leads the Global Cybersecurity and Technology Controls organization, which is responsible for identifying technology and cybersecurity risks and for implementing and maintaining controls to manage cybersecurity threats. The CISO is responsible for J.P. Morgan's Information Security Program, which is designed to prevent, detect and respond to cyber-attacks to help safeguard the confidentiality, integrity and availability of J.P. Morgan's infrastructure, resources and information. The program includes managing J.P. Morgan's global cybersecurity operations centers, providing training, conducting cybersecurity event simulation exercises, implementing J.P. Morgan's policies and standards relating to technology risk and cybersecurity management, and enhancing, as needed, J.P. Morgan's cybersecurity capabilities.


text: J.P. Morgan's board of directors oversees the Information Security Program (the "Program") and a robust governance structure is designed to monitor, report, and escalate the status of information and cybersecurity risks. This structure uses key governance forums to disseminate management information and monitor Program efforts including through the use of key metrics. Established at multiple levels throughout J.P. Morgan, these forums include representatives from each line of business and relevant corporate functions including independent risk management and internal audit. The audit committee of J.P. Morgan's board of directors reviews and approves the Program.


text: Oversight of Global Technology. including J.P. Morgan's technology risk framework, comes from the Chief Information Officer and the Global Technology Operating Committee.


text: J.P. Morgan's Information Security Program includes the following functions: • Cyber Operations, which is responsible for implementing and maintaining controls designed to detect and defend us, the Adviser, J.P. Morgan, and its affiliates against cyberattacks, and includes a dedicated function that monitors for cybersecurity threats and vulnerabilities among our, the Adviser, J.P. Morgan and its affiliates third-party suppliers. • Technology Governance, Risk & Controls, which is responsible for delivering and operationalizing key risk and control frameworks, regulatory discovery, control catalogs and assessments of controls, as well as overseeing governance and reporting of technology and cybersecurity risk. • Enterprise Product and Line of Business Security, which oversees the cybersecurity and technology controls for business products and applications. • Assurance & Enterprise Architecture, which oversees the effectiveness of technology used in connection with cybersecurity controls, data and programs.


text: J.P. Morgan's Security Awareness Program includes training that reinforces compliance with its policies, standards and practices relating to information technology risk and security management. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protects our, the Adviser's, J.P. Morgan's and its affiliates' resources and information. This training is mandatory for all employees globally on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests. Finally, J.P. Morgan's Global Privacy Program requires all employees to take periodic awareness training on data privacy. This privacy-focused training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: The governance structure for the Global Cybersecurity and Technology Controls organization is designed to appropriately identify, escalate and mitigate information security risks, including through the use of key governance forums that inform management concerning the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: The Cybersecurity and Technology Controls Operating Committee ("CTOC") is the principal management committee that oversees J.P. Morgan's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of J.P. Morgan's Information Security Program. The membership of the CTOC includes representatives from the Global Cybersecurity and Technology Controls organization and relevant corporate functions, including Independent Risk Management ("IRM") and Internal Audit. The CTOC includes members of J.P. Morgan management that have extensive experience in various technology and information security disciplines, including relevant employment in financial services and other highly regulated industries.


text: The CTOC is responsible for the governance of the firmwide Global Technology organization, including oversight of firmwide technology strategies, the delivery of technology and technology operations, the effective use of information technology resources, and monitoring and resolving key operational risk and control matters arising in the Global Technology organization. The CTOC escalates key operational risk and control issues, as appropriate, to the GTOC or its business controls committee.


text: Cybersecurity risk management and its governance are integrated into J.P. Morgan's operational risk management framework, including through the escalation of key risk and control issues to our Company's management team and our board of directors. In addition, the Adviser works with J.P. Morgan to assess and challenge activities and risk management practices relating to the identification, assessment, measurement and mitigation of cybersecurity risk.


text: As needed, the Adviser collaborates with J.P. Morgan to engage third-party assessors or auditing firms with industry-recognized expertise on cybersecurity matters to review specific aspects of its cybersecurity risk management framework, processes and controls.


text: As part of its oversight of its risk management framework J.P. Morgan's Cybersecurity Team provides our board of directors with periodic updates concerning cybersecurity risk matters. These updates generally include information regarding cybersecurity and technology developments, J.P. Morgan's Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Adviser's and J.P. Morgan's efforts to address those incidents. Our audit committee assists our board of directors in this oversight.


text: We take a comprehensive approach to cybersecurity and prioritize the security and integrity of our data, including those of our customers and other stakeholders, as a top priority. Our board of directors (in particular our audit committee) and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make appropriate investments to maintain the security and integrity of our data. There can be no guarantee that our established policies, standards, processes and practices will be properly followed in every instance or that they will be effective at mitigating all cybersecurity threats. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our board of directors in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and updates are presented to our board of directors and members of management, as appropriate.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and other developing cybersecurity practices.


text: We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our response to a cybersecurity incident.


text: We have implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in our risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual certifications of our policies as well as periodic security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal health information (including clinical trial data) ("Information Systems and Data").

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: Our information technology function, which is led by Samir Gharib, our President, Chief Financial Officer, and Chief Compliance Officer, helps identify, assess and manage the Company's cybersecurity threats and risks. Our information technology function works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, employing both automated and manual tools and controls; conducting threat and vulnerability assessments; utilizing third-party services to monitor our information technology infrastructure; and performing internal audits.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, incident detection and response policies, network security controls for certain systems (including as applicable data segregation, data encryption, access controls, physical security, and systems threat monitoring), disaster recovery and business continuity plans, vendor risk management program, and dedicated cybersecurity staff and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and the information technology function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, Mr. Gharib and the audit committee of the board of directors evaluate material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers and managed cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, and supply chain providers. We have a vendor management program to manage cybersecurity risks associated with our use of service providers. The program includes, as applicable, risk assessment for certain vendors, security questionnaires, review of certain vendors' security programs and security assessments, and imposition of cybersecurity-related contractual obligations for some vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the sections titled "Risk Factors— If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" and "Risk Factors— We are subject to stringent and evolving obligations related to data privacy and security. These obligations include U.S. and foreign laws, regulations, and rules; contractual obligations; industry standards; and policies. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations and actions (which could include civil or criminal penalties); private litigation, (including class-action claims) and mass arbitration demands; disruptions to our business operations; adverse publicity; and other adverse consequences that could negatively affect our operating results and business."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including Mr. Gharib, who oversees enterprise risk management and information security for the Company.


text: Mr. Gharib is responsible for hiring information security personnel, integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Mr. Gharib is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response and vulnerability management processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Mr. Gharib and the Chief Executive Officer. Mr. Gharib works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes and policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from Mr. Gharib concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. In collaboration with our external vendors specializing in cybersecurity management, we routinely assess material risks from cybersecurity threats, including any potential unauthorized access to our information systems that could result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments of planned material changes in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. In consideration of the size and complexity of our business, we devote appropriate internal and external resources to manage material risks from cybersecurity threats. We also designate senior-level personnel, including our Vice President, Information Technology who reports to our Chief Financial and Business Officer, to manage the risk assessment and mitigation process and to closely coordinate with our General Counsel on applicable regulatory obligations.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through required policy review and trainings at the time of hire and periodically during their employment with us.


text: We engage consultants, auditors, or other third parties in connection with our risk assessment processes. These professionals assist us in the design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards. In addition, in order to mitigate cybersecurity risks associated with our use of third-party service providers, we require certain third-party service providers to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our computer systems, or those of any of our CROs, manufacturers, contractors, consultants or other third parties or potential future collaborators, may fail or suffer security incidents or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: One of the key functions of our board of directors (our "Board") is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.


text: Our Vice President, Information Technology, along with the members of our Incident Response Team, which includes our Chief Financial and Business Officer and our General Counsel, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Incident Response Team is supported by an experienced managed service provider and an incident response provider with extensive global cybersecurity expertise, who both monitor, assess and report threats to us. Additionally, our Vice President, Information Technology has over twenty years of experience operating in the information technology, security and cybersecurity space. In particular, he has experience with cybersecurity assessment and prevention, incident responses, breach notifications and remediation.


text: Our Vice President, Information Technology oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above and, along with and informed by the Information Technology organization and our Incident Response Team, monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Depending on the severity of the security incident, the Incident Response Team will report the security incident to our Audit Committee, including the financial impact of the security incident and any regulatory violations. As our Information Technology organization monitors the security and effectiveness of our policies and procedures, they also work to keep the Vice President, Information Technology and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure.


text: Our Vice President, Information Technology provides an annual briefing to the Audit Committee regarding our company's cybersecurity risks and activities, including the status of cybersecurity system development, company-wide cybersecurity training programs, material changes to the cybersecurity system, policies or practices, any recent cybersecurity incidents and related responses, cybersecurity systems testing and engagement of third-party service providers in support of our cybersecurity system. Special meetings may also be called with the Audit Committee to brief the members on any material cybersecurity incidents and related responses thereto. Subsequent to such briefings, our Audit Committee will provide an update to the Board on such reports. In addition, the Board will receive periodic updates in meeting materials or directly from our Chief Financial and Business Officer on cybersecurity risks and activities.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of our risk management program, including cybersecurity and other information technology risks. The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Singular Genomics Systems, Inc.


text: Our management team, including each of our Chief Financial Officer, Head of IT and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel. Our management team's cumulative experience includes many years of experience managing cybersecurity risks including serving in similar roles leading and overseeing cybersecurity programs at other companies.


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the information technology environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program based on the Center for Internet Security ("CIS") Controls. While this does not imply that we meet any particular technical standards, specifications or requirements, we use the CIS Controls framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational and financial risk areas. Our cybersecurity risk management program includes: (i) risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise information technology environment; (ii) full-time internal subject matter experts and a service desk with extensive security knowledge and skill responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; (iii) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; (iv) cybersecurity awareness training of our employees; and (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.


text: We have implemented and maintain processes designed to identify, assess and manage material risks from cybersecurity threats to our computer networks, third party hosted services, communications systems, hardware and software, and our data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal information of employees and others ("Information Systems and Data").

companyName: Forte Biosciences, Inc.

ticker: FBRX


text: Our information technology consultants help identify, assess and manage the Company's cybersecurity threats and risks. Our information technology consultants identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated cybersecurity tools such as malware scans and; vulnerability testing.


text: Depending on the environment, we implement and maintain technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate risks from cybersecurity threats to our Information Systems and Data, including, for example: employee training; access controls; data encryption; systems monitoring; regular patching of operating systems and software; and a password policy.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our information technology consultants work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to perform a variety of functions throughout our business, such as electronic communications service providers, cloud-based file storage service providers, and contract manufacturing and research organizations.


text: We evaluate the cybersecurity posture of such third-party service providers, including whether such providers maintain appropriate security measures and, where appropriate, require them to implement and maintain reasonable security measures in connection with their work with us. Our Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives updates, as needed, on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: We are cognizant of the evolving risks associated with cybersecurity and recognize a material cybersecurity incident could adversely impact our financial results and condition. We further recognize the importance of maintaining processes to identify, mitigate, and manage those cybersecurity threats. No cybersecurity threats occurred during the year ended December 31, 2023 that have had, or are reasonably likely to have had, a material impact on our business or financial results.

companyName: FreightCar America, Inc.

ticker: RAIL


text: We utilize the National Institute of Standards and Technology ("NIST") framework with our security program to identify, mitigate, and manage cybersecurity risks. We have implemented controls and a formal security policy following this framework. This security policy functions in conjunction with other policies, such as our acceptable use policy and our mobile device policy. We also maintain a specific incident response policy and procedure document including notification and participation of key workforce personnel and external stakeholders to contain, eradicate, and recover from any security incidents.


text: The Company emphasizes the importance of security awareness to our workforce through the administration of third-party cybersecurity training and prioritizes the monitoring and prevention of unauthorized access to Company information technology ("IT") assets such as networks, computers, mobile devices, applications, and stored information. Our internal IT team considers cybersecurity capabilities of third-party service providers prior to engaging them and on an ongoing basis. Our key external IT vendors provide the Company with system and organizational control reports that are reviewed by our internal IT team and may reveal potential security risks.


text: A third-party managed security services provider ("MSSP") works in tandem with our internal IT team to implement and maintain processes and procedures to detect and handle identified security incidents, including the performance of phishing simulations to evaluate our workforce's ability to recognize malicious emails. Our MSSP team leaders have significant experience working in cybersecurity and employ a trained workforce designed to provide proactive and comprehensive cybersecurity care. Together with our MSSP, we also monitor the frequency and extent of cybersecurity threats and update our processes and procedures as necessary. On an annual basis, our internal auditors perform penetration testing and other assessments.