text: The Company's Vice President, Head of IT, Associate Director, IT Operations & Security, IT Steering Committee, Information Security Team, and third-party service providers (collectively, the "Information Security Function") help identify, assess, and manage the Company's cybersecurity threats and risks. The Information Security Function identifies and assesses risks from cybersecurity threats by monitoring and evaluating the Company's threat environment and risk profile using various methods and tools including, for example: subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and bad actors, conducting scans of the threat environment, and evaluating our industry's risk profile and threats reported to us. We also complete certain internal and external security audits, third party threat assessments, and vulnerability assessments.


text: The Company implements and maintains technical, physical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures include, for example: risk assessments, implementation of certain security standards and certifications, encryption of certain data, access and network security controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, and an incident response plan. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's Information Security Team maintains a risk register related to information and security threats and evaluates and manages material risks from cybersecurity threats against our overall business objectives. This information is reviewed with the IT Steering Committee and communicated to the audit committee of the board of directors, which evaluates the Company's risks relating to data privacy, technology and information security, including cybersecurity.

companyName: Vor Biopharma Inc.

ticker: VOR

secItem: Item 1C


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, external legal counsel, and dark web monitoring services. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers, which includes reviewing vendor security audits and reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of our third-party vendors, collaborators, consultants or other third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to a material disruption of our product development programs, regulatory investigations or actions, litigation, fines and penalties, reputational harm and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Associate Director, IT Operations and Security, who oversees the ISMS and Information Security Team and reports to the Vice President, Head of IT. The Vice President, Head of IT is responsible for strategic leadership of our cybersecurity risk management program. The Vice President, Head of IT is responsible for hiring appropriate personnel, approving budgets, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT role is currently held by an individual who has approximately 35 years of professional IT management experience. The Associate Director, IT Operations and Security leads the operational and ISMS oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare employees and third-party service providers to address cybersecurity risks. The Associate Director, IT Operations and Security has approximately 10 years of experience in IT including infrastructure and cloud administration, participation in risk management and incident response activities, vendor management, and ensuring information security policy compliance.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer, and the Chief Executive Officer. The Company's information technology department and managed service partners work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors and the chair of the board of directors for certain cybersecurity incidents. The audit committee of the board of directors periodically receives summaries or presentations from the Vice President, Head of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. Such processes are set forth in our joint Cybersecurity Policy and Disaster Recovery Plan (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy sets forth the role of the information security committee ("Information Security Committee") in preparing, implementing, and maintaining incident response procedures in consultation with senior management of the Adviser and Administrator.

companyName: Runway Growth Finance Corp.

ticker: RWAY


text: Our Information Security Committee is responsible for the development and implementation of policies and technical measures to reasonably prevent security incidents. The Information Security Committee includes our Chief Financial Officer, Chief Compliance Officer and legal representative. At times we may also engage assessors, consultants, or other third parties to assist with assessing, identifying and managing cybersecurity risk. As part of our risk management process, we conduct assessment and penetration testing, including regular trainings completed by employees of RGC who provide services to us pursuant to the Advisory Agreement and Administration Agreement.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this Annual Report on Form 10-K under the heading "Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, results of operations or financial condition."


text: Oversight of Cybersecurity Risks Our cybersecurity risks and associated mitigation strategies are evaluated by our management and the Information Security Committee as needed, but no less frequently than annually. On at least a quarterly basis, management and the Information Security Committee report to our Board of Directors on developments to cybersecurity risks we face. Such reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks that are material to us.


text: The Company prioritizes the security of its information systems and data integrity. We have developed a cybersecurity strategy, underpinned by our Cybersecurity Incident Response Plan, to manage and mitigate potential cybersecurity risks. Our strategy is designed to safeguard our systems and data.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: The Company's cybersecurity framework encompasses a proactive approach towards potential threats, focusing on prevention, detection, response, and recovery. Our cybersecurity risk management program is integrated into our overall risk management framework and shares common reporting channels and governance processes that apply across the risk management framework to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers and software, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees; and • a global incident response plan that includes procedures for responding to cybersecurity incidents.


text: Our Incident Response Team ("IRT"), which includes members from various functional areas within the Company, including our data center operations, software, internal information systems, customer support, legal, and marketing departments, which are responsible for managing and mitigating any cybersecurity incidents at the Company. This team operates under the policy procedures that are outlined in our Cybersecurity Incident Response Plan. This process includes notifying executive management when a cybersecurity breach or incident takes place, and taking necessary containment and mitigation steps to address the incident. Our comprehensive approach is designed to provide minimal impact on our operations and maintain the confidentiality and integrity of the personal information we handle.


text: Regular penetration testing, conducted by independent firms, forms a crucial part of our risk assessment process. These tests help us identify and mitigate potential vulnerabilities in our network security and data handling practices. Additionally, the Company monitors alerts and advisory statements from the Cybersecurity and Infrastructure Security Agency to keep abreast of relevant threats, vulnerabilities or alerts from actual incidents.


text: Our information technology management team has over two decades of experience in the technology industry in developing security strategies, playing a pivotal role in incident identification, leading security teams, and managing risks across various industries.


text: Cybersecurity governance at the Company involves executive and Board oversight. Our Board of Directors considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee regularly receives updates from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with less impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.


text: As part of the escalation procedures stated in our Cybersecurity Incident Response Plan, if we become aware that a cybersecurity incident has occurred, our information technology professionals shall notify the CEO and CFO immediately upon recognition of the breach or event, to help ensure high-level involvement and decision-making. The CEO and CFO shall assess the overall impact of the event and its potential impact on the Company's business operations. If deemed significant, the Audit Committee and full Board of Directors shall be informed of the incident.


text: Our cybersecurity policies and practices are regularly reviewed and updated in order to align with evolving threats and regulatory requirements to help ensure the Company complies with relevant laws and regulations and proactively manages cybersecurity risks.


text: Employee Training and Awareness Recognizing the importance of human factors in cybersecurity, the Company invests in employee training and awareness programs. Our efforts are particularly focused on common threats, such as phishing attacks, and we require all employees to complete annual cybersecurity training to stay informed about emerging and evolving cybersecurity threats.


text: Third-Party Service Providers We work with third parties that help us identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: Additional Information We have no t identified any known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Refer to "Item 1A. Risk Factors", including the risk factors that are described under the heading "Cybersecurity and Information Technology Risks," for more information regarding the risks we face from cybersecurity incidents that could adversely impact our business and operations, harm our reputation and subject us to claims or litigation.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trial and development of therapeutic proteins and antibodies ("Information Systems and Data").

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: Our Information Technology ("IT") Department, led by our Vice President of IT, helps identify, assess and manage the Company's cybersecurity threats and risks. Our IT Department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating and assessing threats reported to us, coordinating with law enforcement about certain threats as may be appropriate, conducting internal and external audits and conducting risk and threat assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: our incident response plan, incident detection and response procedures, disaster recovery and business continuity plans, encryption of certain data, network security controls, data segmentation, access and physical security controls, asset management and disposal, monitoring of our systems, employee training, and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and the IT Department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants and managed cybersecurity providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and third parties associated with our clinical trial development, such as contract research organizations and contract manufacturing organizations.


text: We have vendor management processes to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including if our information technology systems, or the information technology systems of our CROs, our CDMOs, service providers, our current and potential future partners or other third parties with whom we work were compromised, we could experience adverse consequences, including but not limited to material disruptions to our business operations, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, or other adverse consequences.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VP of IT, who has over 25 years of IT experience and 10 years of cybersecurity management expertise.


text: Our VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents as appropriate.


text: The audit committee receives periodic reports our VP of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also can request access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), International Organization for Standardization (ISO) 27001, and Payment Card Industry Data Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: KOHLS Corp

ticker: KSS


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including our incident response personnel; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, t hat have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors- Information Systems, Cybersecurity, Data Management, and Privacy Risks".


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives regular reports from management on our cybersecurity risks, and our full Board receives periodic updates. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as significant incidents.


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our Chief Technology Officer (CTO), Chief Risk and Compliance Officer (CRCO), and Chief Information Security Officer (CISO) or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CTO, CRCO, and CISO, has overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 30 years of technology and finance leadership experience across multiple industries for our CTO, over 30 years of experience in the Legal, Risk and Compliance disciplines for our CRCO, and over 20 years of cybersecurity leadership experience for our CISO.


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to help maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes that are designed to assess, identify and manage material risks from cybersecurity threats and includes: maintenance and monitoring of information security policies aligned with global regulatory controls; user and employee awareness of cyber policies and practices; simulated phishing exercises; information systems configuration management; identity and information asset protection; infrastructure security systems; and cyber threat operations with regular monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. We also maintain a cyber incident response plan designed to assist us in identifying, responding to and recovering from cybersecurity incidents. We use the findings from these and other processes to help us improve our information security practices, procedures and technologies. We also collaborate with third parties to assess the effectiveness of our cybersecurity program. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of material risks from cybersecurity threats, as well as to support associated mitigation plans when necessary.

companyName: ASSEMBLY BIOSCIENCES, INC.

ticker: ASMB


text: Cybersecurity is integrated into our overall risk management systems, including our annual enterprise risk management, internal controls, business continuity and crisis management, third-party risk management, insurance risk management, and employee compliance processes. Our Cyber Incident Response Team, comprised of our Vice President, General Counsel and Corporate Secretary, our Executive Director, Accounting and Treasury, and our Executive Director, Information Technology, consults with, or provides input to each of these programs to ensure that material risks from cybersecurity threats are appropriately assessed, identified, and managed.


text: As of the date of this report, there have been no cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business, strategy, results of operations, or financial condition. For additional description of cybersecurity risks and potential related impacts on the Company, refer to the risk factor captioned "Significant disruptions of information technology systems or breaches of data security, including cybersecurity incidents, could materially and adversely affect our business, results of operations and financial condition" in "Item 1A. Risk Factors."


text: While our board of directors has oversight responsibility for risk management generally, the Audit Committee is specifically responsible for overseeing our cybersecurity risk management program to ensure cybersecurity risks are identified, assessed, managed, and monitored. Our Executive Director, Information Technology, who has over 15 years of experience in the cybersecurity field and regularly attends cybersecurity conferences and actively implements new technologies to keep our systems up to date and secure, provides periodic updates to the Audit Committee in this regard, and details our cybersecurity program supported by key performance indicators across the range of cybersecurity functions related to risk management and governance, identity and information asset protection, core security and endpoint security, and cyber threat operations. These updates include descriptions of cybersecurity incidents, including those associated with our third-party service providers. The Audit Committee is responsible for updating our full board of directors on material risks from cybersecurity incidents or threats.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Erasca, Inc.

ticker: ERAS


text: Our program is developed and informed by industry best practices such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and input from expert third-party consultants. It's important to note that our adoption of the NIST CSF serves as a blueprint to aid in the identification, assessment, and mitigation of cybersecurity risks pertinent to our operations, rather than as a certification of compliance with specific technical standards or requirements.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; an IT security team (including Chief Operating Officer (COO)) principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: Our cybersecurity risk management program includes a third-party risk management process for evaluating risks posed by critical service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee oversight of cybersecurity and other information technology risks. The audit committee oversees management's implementation of our cybersecurity risk management program.


text: The audit committee receives reports from management on our cybersecurity risks no less than twice per calendar year. In addition, management updates the audit committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cyber risk management program. The audit committee and the board of directors receive presentations on cybersecurity topics from our COO as part of continuing education on topics that impact public companies.


text: Our management team, including our COO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, the IT security team that is responsible for managing our cybersecurity risks has over 50 years of experience in mitigating cybersecurity risks.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by cybersecurity tools deployed in the IT environment.


text: The audit committee of our board of directors is responsible for the general oversight around cybersecurity-related matters, while our management is responsible for the day-to-day operations around the assessment and management of any cybersecurity risks we might face. Our board of directors and the audit committee, in consultation with management, established and maintain robust procedures and internal controls around cybersecurity. These mechanisms are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems.

companyName: Terns Pharmaceuticals, Inc.

ticker: TERN


text: At each regularly scheduled audit committee meeting, our chief financial officer provides an update on our cybersecurity position, and where necessary, the audit committee then provides an update to the board of directors. Our incident response process also contemplates that the executive team will notify the audit committee of a material cybersecurity incident.


text: We engage an experienced consultant to oversee the day-to-day functions of cybersecurity management, including proactive reviews of activity logs, regular vulnerability scans, and, where applicable, effective incident response. Our expert consultant has over 30 years of experience in the cybersecurity space, and reports to the chief financial officer. We also engage a highly qualified third-party cybersecurity assessor to conduct annual threat assessments and penetration tests. To date, we have not encountered cybersecurity incidents that have materially impacted our operations or financial standing.


text: We recognize the critical importance of maintaining the trust and confidence of our customers and employees. Consequently, we maintain a comprehensive security incident response plan ("SIRP") and we assess, identify, and manage material risks associated with cybersecurity threats. Our SIRP includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: We have integrated cybersecurity risk management into our broader risk management framework through various mechanisms, including (i) our updates to the Cyber Committee, which was created by the Board in 2016 and meets at least quarterly, (ii) our annual enterprise risk management update to the Board, and (iii) our information technology and security related internal controls, including vulnerability management programs.


text: We train employees to understand their role in attempting to protect the Company from cybersecurity attacks. Our information security training program for employees includes acknowledgement of our information security policies, regular internal communications, and testing to measure the effectiveness of our information security program. For example, we conduct regular phishing awareness campaigns designed to emulate current threats and provide immediate feedback and, as necessary, additional training or remedial action.


text: In addition, we engage third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls are regularly tested by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements. Other third-party service providers are enlisted by the Company for security operations center services to augment our teams' monitoring capabilities and to assist with our investigation and response to alerts on emerging and ongoing threats.


text: Further, our cybersecurity team continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. We use various security tools and processes to help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, risk assessment network security controls, detection and response tools and a vulnerability management program.


text: The complexity and evolving nature of cybersecurity threats requires that we engage with a range of external experts, including cybersecurity assessors and consultants, in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights to be confident that our cybersecurity strategies and processes are consistent with industry best practices. Our collaboration with these third parties includes regular threat assessments and consultation on security enhancements.


text: In order to mitigate data or security incidents that may originate from third-party vendors or suppliers, we conduct both privacy and security assessments to properly identify, prioritize, assess and remediate any third-party risks, and we require security and privacy addenda to our contracts where applicable. We currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, or other related breaches.


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. Also see Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.


text: Our Board is ultimately responsible for the risk oversight of the Company, including cybersecurity and privacy risks. Our Board has delegated day-to-day responsibility for oversight of cybersecurity risks to the Cyber Committee. The Cyber Committee is composed of members of our Board who have diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Pursuant to its charter, our Cyber Committee: • assists our Board in fulfilling its risk oversight responsibilities with respect to the protection of the Company's assets, including confidential, proprietary and personal information, reputation and goodwill in all forms; • supervises and monitors the soundness of our cybersecurity and data protection strategies and practices; • oversees and monitors our material compliance with applicable information security, privacy and data protection laws, industry standards and contractual requirements; • promotes and furthers the integrity, adoption and coordination of our data security processes across the Company to help ensure that data and system security is a Company-wide business objective and priority; and • oversees our cybersecurity and data protection performance and the overall implementation of our cybersecurity and data protection strategy.


text: At the management level, our Chief Technology Officer and our Senior Vice President, Technology and Innovation, as well as our technology staff, are primarily responsible for identifying, assessing, monitoring and managing our cybersecurity. Our Chief Technology Officer reports directly to our President and Chief Executive Officer and meets at least quarterly with the Cyber Committee. Our current Chief Technology Officer has over 35 years of industry experience, including service as a Chief Technology Officer/Chief Information Officer for over seven years and extensive experience in developing and leading technology risk management programs. Our Senior Vice President, Technology and Innovation reports directly to the Chief Technology Officer and has over 32 years of industry experience with the Company. He has led the Company's cybersecurity team and overseen PCI certification for the past seven years, ensuring compliance with industry standards and strengthening the organization's security posture. Additionally, our technology staff holds multiple industry-standard security certifications, including Cisco Certified Network Associate, PCI Internal Security Assessor, and Certified Ethical Hacker.


text: We maintain a data security plan designed to provide a documented and formalized information security policy to detect, identify, classify and mitigate internal and external cybersecurity and other data security threats. This cybersecurity program is based in-part on, and its effectiveness is measured using applicable industry standards, and is integrated into our overall enterprise risk management program. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes.

companyName: Shimmick Corp

ticker: SHIM


text: In furtherance of detecting, identifying, classifying and mitigating cybersecurity and other data security threats, including such threats associated with our use of any third-party service providers, we also: • assess and analyze baseline configuration standards to ensure that they meet the intent and effectiveness required for the overall safety and security (both logically and physically) of critical system components; • ensure the asset inventory for relevant system components is kept current and accurate; • ensure that network connection arrangement documents are kept current and accurate; • limit access rights to system components to authorized personnel only, with all end-users being properly granted access in accordance with stated access rights policies and procedures; • deploy anti-virus solutions on all applicable system components, with the respective anti-virus solutions being the most current versions available from applicable vendors, enabled for automatic updates and configured for conducting periodic scans as necessary; • provision, hardens, secures and locks down critical system resources; • use internal and external vulnerability scanning procedures, along with network layer and anti-hacking tests; • facilitate requests for validation of baseline configurations for purposes of regulatory compliance assessments and audits; and • provide mandatory training and optional certification accreditation for purposes of maintaining an acceptable level of information security expertise necessary for configuration management.


text: Conducting our businesses involves the collection, storage, use, disclosure, processing, transfer, and other handling of a wide variety of information, including personally identifiable information, for various purposes in our businesses. Like other comparable-sized companies that process a wide variety of information, our information technology systems, networks and infrastructure and technology have been, and may in the future be, vulnerable to cybersecurity attacks and other data security threats. As of the date of this Form 10-K, we do not believe any risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations or financial condition. However, cybersecurity attacks are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target. Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information about these and other cybersecurity risks faced by us, see "Risk Factors – Risks Related to Our Business and Industry – We rely on IT systems to conduct our business, and disruption, failure or security breaches of these systems could adversely affect our business and results of operations" and "– Cybersecurity attacks on or breaches of our information technology environment could result in business interruptions, remediation costs and/or legal claims".


text: Our board of directors has ultimate oversight for risks relating to our data security plan. In addition, the board of directors has delegated primary responsibility to the Audit Committee for assessing and managing data privacy and cybersecurity risks, reviewing data security and cybersecurity policies and processes with respect to data privacy and cybersecurity risk assessment and management, reviewing steps management has taken to monitor and control such risks, and regularly inquires with our management team, internal auditors and independent auditors in connection therewith. The Audit Committee is also responsible for overseeing our investigation of, and response to, any cybersecurity attacks or threats.


text: We also have a dedicated team of employees overseeing its data security plan and initiatives, led by our Director of IT. With over fifteen years of experience in the field of cybersecurity, our Director of IT brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Director of IT also works directly in consultation with internal and external advisors in connection data security planning and initiatives. We engage such external advisors to assist with the evaluation of our technology, security, critical risk areas and related controls to improve our ability to identify and detect, protect against, and recover from, cybersecurity incidents and other evolving threats and to appropriately benchmark against industry practices.


text: We have developed a procedure by which the board of directors and management are informed about relevant cybersecurity risks, allowing for effective cybersecurity oversight and the ability of the Company to monitor, prevent, detect, mitigate and remediate cybersecurity incidents. The results of our evaluations and the feedback from its engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.


text: In the event of a potential or actual cybersecurity event, the Director of IT immediately notifies general counsel at which point the information security incident response plan is activated if warranted. The information security incident response plan provides the procedures for responding, including personnel required to be informed and updated. The board of directors is informed promptly in the event such incident is, or is reasonably expected to have, a material impact on operations or financial condition.


text: The Fund has processes in place designed to assess, identify, and manage material risks from cybersecurity threats. The Fund's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages the Fund's day-to-day operations and has implemented a cybersecurity program that applies to the Fund and its operations.

companyName: John Hancock Comvest Private Income Fund


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Fund. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Fund relies. The Investment Adviser, together with external consultants, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Fund.


text: The Fund relies on the Investment Adviser's compliance and risk management program and processes, which include periodic review of the Investment Adviser's cybersecurity program.


text: The Fund depends on and engages various third parties, including service providers, to operate its business. The Fund relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, as well as the Fund.


text: Management's Role in Cybersecurity Risk Management The Fund's management, including the Fund's CCO and the Investment Adviser's Technology Risk and Information Security Committee (the "Committee"), manage the Fund's cybersecurity program. The CCO of the Fund oversees the Fund's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Adviser's Chief Financial Officer, General Counsel, and Director of Information Technology. The CCO has been responsible for this oversight function since the Fund's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Fund.


text: The Fund's senior management team is regularly informed regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, and/or other comparable SEC regulated investment funds and their managers, including through the receipt of notifications from service providers and reliance on communications with operations, risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Fund believes have materially affected, or are reasonably likely to materially affect, the Fund, including its business strategy, operational results, and financial condition.


text: Strategy and Oversight We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical studies and employees, or our information systems and the data contained therein.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: We retain a Chief Information Consultant to collaborate with the company, including the Chief Financial Officer, and Executive Leadership Team, to help identify, assess and manage the company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, and evaluating threats reported to us. We also use a third-party security management vendor to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems, including, for example, incident detection and response policy, route risk assessments, data encryption, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, and cybersecurity insurance. As part of our information security program, we provide mandatory periodic training for all employees on how to identify potential cybersecurity risks and protect our resources and information. This training is supplemented by firmwide testing initiatives, including periodic phishing tests.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Chief Information Consultant works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, our Chief Financial Officer evaluates material risks from cybersecurity threats and, as appropriate, reports to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled " We depend on our information systems and those of our third-party collaborators, service providers, contractors or consultants, which may fail or suffer cybersecurity incidents that could result in a material disruption of our development programs or loss of data and have a material adverse effect on our reputation, business, financial condition or results of operations."


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by our Chief Financial Officer who oversees the work performed by our Chief Information Consultant.


text: Our Chief Financial Officer is responsible for hiring appropriate consultants, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Chief Financial Officer, with support from our Chief Information Consultant, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The Audit Committee receives periodic reports from our Chief Financial Officer concerning our significant cybersecurity threats and risks and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. The Chief Financial Officer also promptly informs and updates the Board about any information security incidents that may pose significant risk to our Company.


text: The Chief Financial Officer has over 20 years of operations and leadership experience, including experience in information technology strategy and execution. The Chief Information Consultant has over 20 years of experience managing and securing technology infrastructure.


text: We recognize the importance of maintaining the trust and confidence of our patients, our collaborators, our business partners, our investors, and our employees and understand how key it is to maintain their confidence in our ability to properly protect and manage our information technology systems, infrastructure and data as part of that trust and confidence. In order to achieve this, our management team and our Board of Directors are actively involved in the oversight of our cybersecurity program as part of our approach to risk management.

companyName: BioAge Labs, Inc.

ticker: BIOA


text: We depend on the functioning, availability and security of our information systems, including financial, data processing, communications and operating systems. Several information systems, such as software applications and cloud platforms, are provided by third parties. Our cybersecurity risk framework is designed to allow us to identify, assess and manage the cybersecurity risks we face in relation to, our systems and the information we process.


text: As part of our framework, we maintain certain processes defined to assess, identify and manage risks. For example, we have an incident management and response process under which we communicate the details of certain threats and incidents to management and the audit committee of the board of directors as may be appropriate; use manual and automated processes that are designed to monitor relevant information systems for vulnerabilities, threats and incidents; manage and take certain actions designed to address incidents that may occur; and take actions designed to remediate certain vulnerabilities identified in relevant environments. We employ an array of data security technologies, processes, and methods across our infrastructure designed to protect our systems and sensitive information from unauthorized access. We work with information technology consultants who provide advice and expertise on monitoring evolving industry practices. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, certain management executives, including our Senior Director of Information Technology and Chief Financial Officer evaluate material risks from cybersecurity threats in connection with our overall business objectives and reports such evaluations to the audit committee of the board of directors as appropriate, which then evaluates our overall enterprise risks. In addition to the third parties above, we use additional third-party service providers to perform a variety of functions throughout our business, such as enterprise and employee management platforms, labs, contract research organizations, contract manufacturing organizations, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, we take steps designed to address cybersecurity risks that such service providers may present to us, such as conducting diligence into such service providers' cybersecurity practices and risk profiles.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "We are dependent on the efficient and uninterrupted operation of our information technology systems, and those systems, or those of our third-party service providers, may be impacted by security incidents, cyberattacks, loss of data and other disruptions, which could adversely impact our business."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Senior Director of Information Technology, who has more than two decades of information technology and information technology leadership experience. Our Senior Director of Information Technology, under the supervision of our Chief Financial Officer, manages and monitors our cybersecurity risk (including that presented by our information technology service providers). Our Senior Director of Information Technology is responsible for informing our Chief Financial Officer of relevant cybersecurity risks including, as relevant, the prevent, detection, mitigation and remediation of cybersecurity incidents. Our Chief Financial Officer has over two decades of management experience, including oversight over information technology and cybersecurity matters.


text: Our Board of Directors, with the assistance of the Audit Committee, has oversight for the cybersecurity risks facing us and for our processes designed to identify, prioritize, assess, manage, and mitigate those risks. As part of its oversight responsibilities, the Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures (including, as relevant, those stemming from certain cybersecurity incidents) from our Senior Director of Information Technology and Chief Financial Officer.


text: We have implemented various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including sensitive and confidential information (including intellectual property and tenant and property-related information) that is proprietary, strategic, or competitive in nature ("Information Systems and Data"). Our information security processes are overseen by an outsourced IT Manager, with oversight from our Chief Operating Officer, who works to help identify, assess, and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using various methods. We have implemented and maintain technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including with respect to incident response, network security controls, access controls, periodic back-ups of data, and employee training addressing awareness of cybersecurity risks and how to detect certain cyberattacks. Some of these measures and processes involve the assistance of additional third-party service providers. For example, we rely on third-party service providers to assist us with our employee phishing testing and cybersecurity awareness training.

companyName: FrontView REIT, Inc.

ticker: FVR


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's overall risk management processes include an assessment of risks posed to data that is critical to our business operations (e.g., to support financial reporting, process payroll, and collect and maintain property and lease information).


text: Third Party Risk Management We use third-party service providers to perform a variety of functions throughout our business, including application providers and hosting companies. The Company has implemented a risk-based approach designed to help identify and mitigate cybersecurity threats associated with the use of third-party service providers, including an assessment of the security protocols of certain service providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our third-party service provider risk management process involves different levels of assessment designed to identify cybersecurity risks associated with the provider and imposes contractual obligations related to cybersecurity on the provider.


text: As of the date of this Report, we have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incident, that has materially affected us, or is reasonably likely to affect us, including our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that we face, see our risk factors under Part 1. Item 1A. Risks Related to our Business and Properties - Security breaches and other technology disruptions could disrupt our operations, compromise our confidential information or information systems and expose us to liability, which could materially and adversely affect us.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general risk oversight function, and has delegated responsibility to the audit committee for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The audit committee reviews the processes developed by management to assess, monitor, manage, and mitigate risks from cybersecurity threats to the Company. The audit committee will review our cybersecurity processes and cybersecurity threats, and will brief the entire board of directors on these processes and threats, in each case on at least an annual basis.


text: Our cybersecurity risk assessment and management processes are overseen by our Chief Operating Officer and the IT Manager, who has worked in various roles responsible for securing networks, hardware, and other application systems. Our outsourced IT team is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: Our cybersecurity incident response processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances, including senior management. The Company has identified and designated a group of Company employees as members of a cybersecurity incident response team, which includes the Chief Financial Officer. This team is intended to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process also requires reporting to the audit committee about certain cybersecurity incidents.


text: The Company's Information Technology team has established an information security management system to safeguard the confidentiality, integrity, and availability of the Company's products, infrastructure, and data. This system is integrated with our Quality and Business Management Systems and aims to identify, assess, and address cybersecurity risks affecting our business. It features an Incident Response Procedure ("IRP") that specifies roles and responsibilities during security incidents, detailing incident detection, investigation, mitigation, and prompt incident reporting procedures.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: Additionally, we conduct regular internal assessments and audits, complemented by insights from external experts. The outcomes of these evaluations are communicated to senior leadership. Based on these risk assessments, we redesign, implement, and maintain adequate safeguards to reduce identified risks, address gaps, and continuously assess the efficacy of these measures. Our engagement with our key partners, vendors, customers, industry stakeholders, and government bodies is ongoing, aiming to improve our information security policies and procedures over time. We aim to diligently manage risks related to cybersecurity threats from third-party service providers, including, when possible, requesting our service providers to report incidents that may compromise the Company's data.


text: Risks from Threats and Incidents Our IT infrastructure, encompassing operational and security systems, integrated software, and data processed by us or our third-party vendors, is vulnerable to cybersecurity threats and incidents. As of December 31, 2024, these risks have not significantly impacted the Company, including our business strategy, or operational results, or financial results. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Part I, Item 1A. "Risk Factors" of this report for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Our Chief Technology Officer is tasked with assessing and managing significant cybersecurity risks across the Company based on the assessments of our IT Director. Our IT Director brings substantial IT and Information Security expertise from various roles in the technology industry.


text: The IT Director leads and coordinates cybersecurity efforts at Aeva, providing regular updates on cybersecurity progress to the senior leadership team. The Information Security team actively shares updates on the status of cybersecurity efforts and risks, evaluates our information security programs, and monitors the evolving threat landscape on a company-wide level.


text: The Audit Committee oversees our cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats and incidents. When incidents occur, depending on the nature and severity, the Audit Committee is notified, and incidents are further reviewed with the Audit Committee. Material cybersecurity matters will be reviewed with the full Board of Directors.


text: Our risk management program is designed to identify, assess, and mitigate risk across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Senior Technology/Cybersecurity Officer is primarily responsible for this cybersecurity component and is a key member of the Company's Information Technology Governance, along with our Chief Finance/Information Security Officer, including the Enterprise Risk Management Committee ("ERM"), the Information Technology Steering Committee ("ITSC") and the Information Technology Advisory Committee ("ITAC"), reporting directly to the Chief Information Officer. Our Senior Technology/Cybersecurity Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 31 years of cybersecurity experience, 6 of which was spent at the Company. The ITAC and ERM are board level committees with the ITSC consisting of members of management.

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Finance/Information Security Officer and our Chief Information Officer, report directly to our Chief Executive Officer, and along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: The Company employs an in-depth, layered, defensive strategy that embraces a "secure by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a portion of our workforce has the option to work remotely. We leverage internal auditors to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below. The IRP is coordinated through the Chief Finance/Information Security Officer, Senior Technology/Cybersecurity Officer and key members of management are embedded into the IRP by its design. The IRP facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company.


text: Our Chief Finance/Information Security Officer has oversight of information security across the organization, with the Senior Technology/Cybersecurity Officer independently accountable for managing our enterprise information security department and delivering our information security program. The responsibility of this role includes cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first and second line of defense functions. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Information Officer. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. Our Senior Technology/Cybersecurity Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the ITAC, which focuses on technology impact, and ERM, which focuses on business impact while the ITSC is an internal management committee providing direction and priorities to information technology strategies. These committees provide oversight and governance of the technology program and the information security program. The ITAC and ERM are chaired by certain members of the board of directors with senior management participation including the Chief Finance/Information Security Officer, Chief Information Officer, Senior Technology/Cybersecurity Officer as well as other key departmental managers from throughout the organization. These committees meet periodically to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the IRP in order to facilitate timely informing and monitoring efforts. The Senior Technology/Cybersecurity Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the ITAC on a quarterly basis (or more frequently as may be required by the IRP).


text: The ITAC is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Finance/Information Security Officer, Senior Technology/Cybersecurity Officer and our Chief Information Officer provide quarterly reports to the ITAC and ERM regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The ITAC reviews and approves our information security and technology budgets and strategies annually. Additionally, the ERM reviews our cyber security risk profile on a quarterly basis. The ITAC and ERM provide a report of their activities to the board of directors regularly.


text: We take a comprehensive approach to cybersecurity and prioritize the security and integrity of our data, including those of our residents and other stakeholders, as a top priority. Our board of directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make appropriate investments to maintain the security and integrity of our data. There can be no guarantee that our established policies, standards, processes and practices will be properly followed in every instance or that they will be effective at mitigating all cybersecurity threats. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.

companyName: Strategic Student & Senior Housing Trust, Inc.

ticker: STSR


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and resident information, identifying, preventing and mitigating cybersecurity threats. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our board of directors in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and updates are presented to our board of directors and members of management, as appropriate.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and other developing cybersecurity practices.


text: We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans. Our incident response and recovery plans address—and guide our response to—a cybersecurity incident.


text: We have implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in our risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness We regularly remind employees of the importance of handling and protecting resident and employee data, including through annual certifications of our policies as well as periodic security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: As a company externally managed by the Advisor, we rely on Starwood Capital's information technology ("IT") systems, including data hosting facilities and other hardware and software platforms, some of which are hosted by third-party service providers, to assist in conducting our businesses. Starwood Capital's IT systems, like those of most companies, may be vulnerable to certain cybersecurity threats such as ransomware, interruption of services, data breaches, or any other cybersecurity incidents, or a series of related cybersecurity incidents, that could adversely impact our financial condition, results of operations, cash flows or business strategy, including our ability to operate core business functions. In the last fiscal year, Starwood Capital continually monitored the risk landscape and did not experience any cybersecurity breaches, including malware and computer virus attacks that have materially affected, or are reasonably likely to materially affect our financial condition, results of operations, cash flows, or business strategy. For more information on our cybersecurity-related risks, see Part I, "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K.

companyName: Starwood Real Estate Income Trust, Inc.

ticker: SWDR


text: Starwood Capital considers cybersecurity risks, along with other top risks, within its Enterprise Risk Management ("ERM") framework. The ERM framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. Starwood Capital has implemented a cybersecurity program that employs various controls and activities aimed at identifying, protecting against, detecting, and responding to cybersecurity threats. These controls and activities include hardware and software inventory tracking, endpoint protection, and network security measures to safeguard our assets from unauthorized access and attacks. Starwood Capital prioritizes data protection through access management designed to permit access only by authorized personnel. Starwood Capital's cybersecurity incident response plan, integrated into the ERM framework, outlines a structured process for handling information security incidents involving assets or data. It guides Starwood Capital's cybersecurity incident response team in containing, eradicating, and recovering from incidents while minimizing damage and disruption. The plan includes a clearly defined notification framework ensuring timely communication with business and management teams based on the incident's severity and potential impact. Additionally, Starwood Capital maintains a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents. The cybersecurity insurance policy covers both our company and other Starwood Capital affiliates.


text: Starwood Capital also periodically performs simulations and tabletop exercises at a management level and utilizes external resources and consultants, as needed. All employees of Starwood Capital are required to complete an annual computer-based Security Awareness Training Program that includes various topics on cybersecurity risk management best practices. This program educates users on how to identify information security threats and what actions should be taken in the event of a cybersecurity breach. Additionally, the employees of Starwood Capital are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Annual risk assessments of Starwood Capital's Information Security Program are conducted to identify emerging information security and third-party risks. In addition, periodic vulnerability assessments and penetration tests are conducted throughout the year to support the identification of risks.


text: Further, Starwood Capital utilizes on-premises and cloud-based security solutions, with real-time monitoring provided by specialized managed third-party security service providers. These third parties collect events generated by critical systems in real-time, filter non-security events, and then correlate the information using security data analytical engines so that personnel of Starwood Capital can identify and analyze threats. With respect to the software platforms that are hosted by third parties, Starwood Capital utilizes an external vendor risk management platform to evaluate, rate, monitor and track vendor risk. The security practices and processes of our third-party service providers are monitored regularly. In addition, we have engaged a third-party to evaluate and review the remediation of cyber risks of our third party service providers, including financial service providers, property managers and professional service firms. For any hosted applications, Starwood Capital inquires if the vendor issues a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, Starwood Capital takes additional steps to assess its cybersecurity preparedness and assess the relationship on that basis. Starwood Capital's assessment of risks associated with the use of third party service providers is part of Starwood Capital's overall cybersecurity risk management framework.


text: Our board of directors is ultimately responsible for the oversight of risks from cybersecurity threats and has delegated responsibility for such oversight of cybersecurity matters to the audit committee. The audit committee receives at least quarterly, or more frequently as needed, updates from the Advisor on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents.


text: Starwood Capital's Chief Technology Officer, an industry veteran that has been focused on technology for over 40 years and in technology leadership roles at financial institutions for 20 years, leads the overall cybersecurity function and is responsible for developing and implementing Starwood Capital's Information Security Program and managing our response to threats. In addition to its in-house cybersecurity capabilities, at times Starwood Capital also engages third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of Starwood Capital's IT security team, including the third-party security firms utilized as part, of its program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.


text: We believe cybersecurity is critical to advancing our technological advancements. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: MAIA Biotechnology, Inc.

ticker: MAIA


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.


text: As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.


text: Risk Management and Strategy Daily, we are threatened by system intrusions, social engineering attempts and web application attacks. These threats and attempts are directed at payment data, employee credentials, system passwords and personal information. We have developed and implemented a risk-based framework to address them. We consider cybersecurity a top risk within our enterprise risk management protocol, which is subject to oversight by our Board of Directors.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: Our risk-based processes, as designed, seek to maintain physical, administrative and technical controls that protect the confidentiality, integrity and availability of our information systems and information stored on our network, including customer information, personal information, intellectual property and proprietary information.


text: We use the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a guideline for our cybersecurity framework. This does not imply that we meet any technical standards, specifications or requirements under the NIST CSF, only that we use the NIST CSF as a framework to help us identify, assess and manage cybersecurity risks related to our business. Our policies for overall general information technology controls are also influenced by the Control Objectives for Information and Related Technologies, which align with the NIST CST.


text: Our key cybersecurity processes are organized into four primary categories: • Outage and access: these processes address system intrusion and credential and password threats and risks; • Payment and loyalty rewards: these processes protect the information of our customers; • Personal data: these processes protect the payroll and healthcare data of our current and former employees and vendor information; and • Vendor partner security: these processes review the infrastructure and security processes of vendor partners that process transactions, provide cloud-based solutions and provide the backbone for our data flow.