text: Our information security program is regularly evaluated by internal and external parties with the results of certain reviews reported to senior management and the cybersecurity committee. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our cybersecurity committee will also receive prompt and timely information regarding any material cybersecurity threats or incidents, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved, or otherwise addressed. To mitigate the impact of any cybersecurity incidents, we maintain cybersecurity insurance in amounts that we believe are appropriate of our business, which provides coverage for such incidents.


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our customers, partners, and employees, including the importance of managing cybersecurity risks, and we have integrated these policies and procedures into our overall risk management systems and processes. While everyone at our company is expected to play a part in managing cybersecurity risks, our board of directors, as discussed in more detail under "—Governance" below, through delegation to the cybersecurity committee of the board of directors (the cybersecurity committee), and key members of our senior management team, are involved in the oversight of our information security program. Our information security program is based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards, and is integrated into our overall enterprise risk management program. We utilize an overarching framework to address enterprise information security governance, which seeks to protect information assets and systems against attacks and incidents while establishing appropriate security as a priority for our information technology infrastructure and throughout the product development process. Our information security team, including a "red team" of dedicated engineers, and certain cross-functional employees routinely assess material risks from cybersecurity threats, and assess and update our cybersecurity risk management program in response to emerging trends and changes in our operations. We also engage third parties, including consultants and auditors, to evaluate the effectiveness of our risk management program, control environment, and cybersecurity practices through security audits, penetration testing, and other engagements.

companyName: BILL Holdings, Inc.

ticker: BILL

secItem: Item 1C


text: Our information security program is managed by our interim Chief Information Security Officer (CISO), who reports to our Chief Technology Officer and oversees a team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our foundational security engineering, governance risk and compliance, product security and security operations teams report into our interim CISO and provide regular updates on significant or potentially significant threats and incidents. Our interim CISO has nearly 20 years of experience serving in information security roles in healthcare and technology companies.


text: Our information security program includes an incident response program that coordinates activities across multiple teams in responding to cybersecurity incidents in accordance with a defined Incident Management Policy. This program is designed to detect, analyze, and escalate cybersecurity events, and includes a cybersecurity incident response team responsible for containment and recovery activities, and a crisis response team to liaise with business stakeholders, secure priority resources, and validate completion of any post-incident activities. In addition, we have established an executive security risk management committee composed of senior representatives of our legal, finance, information security, product, and marketing teams which meets on a quarterly basis to review our information security program and any noteworthy developments in the quarter. Finally, we coordinate internal simulations of cybersecurity incidents periodically to test the processes we have established.


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We conduct initial due diligence on the cybersecurity profile of our vendors as they are onboarded and provide continuous monitoring of critical third-party infrastructure and monitor any known breaches of those third-party systems. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, result of operations or financial condition. If we or our partners were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "We, our partners, our customers, and others who use our services obtain and process a large amount of sensitive data. Any real or perceived improper or unauthorized use of, disclosure of, or access to such data could harm our reputation as a trusted brand and adversely affect our business, operating results, and financial condition."


text: In light of the critical importance of cybersecurity to our business, in the spring of 2023, our board of directors formed a standing cybersecurity committee. The cybersecurity committee meets quarterly and is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. These reports include updates on our information security risks and threats, any notable incidents, escalations or third-party risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape and company security culture. The interim CISO provides reports at least quarterly to the cybersecurity committee as well as to our Chief Executive Officer, Chief Technology Officer, and other members of our senior management, as appropriate. The cybersecurity committee also receives quarterly updates from our legal department and third-party experts. Our cybersecurity committee provides regular updates to the board of directors on such reports, and coordinates with the audit committee of the board of directors with respect to any risks with implications for our financial reporting, accounting, internal controls or other matters presenting significant financial risk.


text: We assess, identify and manage the material risks from cybersecurity threats relevant to our businesses through robust programs, including enterprise risk management ("ERM"), our risk assessment process ("RAP") and our cybersecurity program. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Vontier Corp

ticker: VNT


text: There is strong engagement in risk management from company leadership, including the CEO, executives and senior leaders. This ERM program is driven by Vontier's Executive Risk Committee, which is led by the SVP, Chief Administrative Officer and comprised of business and functional leaders. Our Audit Committee oversees the ERM program and the Board of Directors have regular updates on topics that are identified through the RAP and overall risk management process.


text: Through the RAP, which is a tool in our ERM program, we identify and assess cybersecurity risks at a business unit level, evaluating the likelihood and potential impact of a risk universe encompassing finance, human capital, operations, information technology, legal and regulatory compliance, and strategy. Risks are individually analyzed from both inherent and residual perspectives, considering existing controls and mitigation processes in place. The businesses leverage the results from the assessment process to identify and implement efforts to further mitigate risks. Progress on mitigation projects is monitored and regularly reported to leadership as part of the RAP. In addition to our ERM and RAP, we have a cybersecurity program led by our Chief Information Officer ("CIO"), who reports to our Chief Financial Officer. Our current CIO has over 20 years of experience with large global companies where he worked extensively in providing strategic IT leadership and management in the areas of digital transformation, cybersecurity, risk management and ERP implementation. Our CIO oversees our Information Security department, chairs the Vontier Information Security Executive Committee ("VISEC"), which includes cross-functional leaders from finance, internal audit, information security, information technology, and legal and corporate affairs, and works with the businesses to conduct enterprise product security assessments, perform penetration testing and advance our cybersecurity policies and procedures. We have developed information security policies and standards based on the NIST Cybersecurity Framework, an internationally recognized framework; and we engage with third parties on our incident response processes, cybersecurity maturity assessment, as well as on our cyber security awareness, data security governance and vendor cyber risk management. Additionally, we review our cybersecurity maturity assessment on an ongoing basis to measure the Company's ability to detect, protect, respond and recover from a cyber incident.


text: The VISEC addresses relevant cybersecurity issues and provides guidance and updates on information security programs and projects. Additionally, the VISEC oversees the coordination of information security mitigation efforts arising from internal assessment, including from the RAP, as applicable. The Board has delegated to the Audit Committee the responsibility of exercising oversight with respect to the Company's cybersecurity risk management and risk controls. Our CIO provides multiple updates each year to the Audit Committee regarding cyber risk management governance and the status of projects that strengthen cybersecurity effectiveness. The full Board regularly receives briefs from the Audit Committee and management regarding the Company's cybersecurity program, including the Company's monitoring, auditing, implementation and communication processes, controls, and procedures.


text: In the event of a cyber incident, our CIO leads the execution of our cyber response plan, which includes a cross-functional group and triggers for escalation. We also have established a business continuity program to assess the cyber risks associated with our critical facilities' ability to recover and resume operational functionality. We continue to engage and educate employees internally on relevant cybersecurity threats.


text: There is strong engagement in risk management from company leadership, including the CEO, executives and senior leaders. The ERM program is driven by Vontier's Executive Risk Committee, which is led by the SVP, Chief Administrative Officer and comprised of business and functional leaders. Our Audit Committee oversees the ERM program and the Board of Directors have regular updates on topics that are identified through the RAP and overall risk management process.


text: Through the RAP, which is a tool in our ERM program, we identify and assess cybersecurity risks at an operating company level, evaluating the likelihood and potential impact of a risk universe encompassing finance, human capital, operations, information technology, legal and regulatory compliance, and strategy. Risks are individually analyzed from both inherent and residual perspectives, considering existing controls and mitigation processes in place. The businesses leverage the results from the assessment process to identify and implement efforts to further mitigate risks. Progress on mitigation projects is monitored and regularly reported to leadership as part of the RAP. In addition to our ERM and RAP, we have a cybersecurity program led by our Chief Information Officer ("CIO"), who reports to our Chief Financial Officer. Our current CIO has over 20 years of experience with large global companies where he worked extensively in providing strategic IT leadership and management in the areas of digital transformation, cybersecurity, risk management and ERP implementation. Our CIO oversees our Information Security department, chairs the Vontier Information Security Executive Committee ("VISEC"), which includes cross-functional leaders from finance, internal audit, information security, information technology, and legal and corporate affairs, and works with the businesses to conduct enterprise product security assessments, perform penetration testing and advance our cybersecurity policies and procedures. We have developed information security policies and standards informed by the NIST Cybersecurity Framework, an internationally recognized framework; and we engage with third parties on our incident response processes, cybersecurity maturity assessment, as well as on our cyber security awareness, data security governance and vendor cyber risk management. Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. Additionally, we review our cybersecurity maturity assessment on an ongoing basis to measure the Company's ability to detect, protect, respond and recover from a cyber incident.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Index to Financial Statements There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives at least quarterly reports from our Chief Digital & Technology Officer and internal security staff on developments in our information technology infrastructure and cybersecurity program. This includes updates, as appropriate, on key information technology initiatives, new and existing cybersecurity risks, and how management is managing risks. In addition, the Chief Digital & Technology Officer updates the Audit Committee, as necessary, regarding any material cybersecurity incidents per our established severity and response framework, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program and an annual report from management on our cybersecurity risks.


text: Our security technology team, led by the Head of Core Technology & Security ("Head of CT&S"), is responsible for managing and directing day-to-day assessment and management of materials risks from cybersecurity threats, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Head of CT&S reports to our Chief Digital and Technology Officer. The Head of CT&S has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He is an ISACA certified security manager and has over 20 years of experience in information technology, with over 10 years specifically focused on cybersecurity risk management.


text: Our management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors. • Risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information, as well as risks of data leakage and unauthorized access to sensitive information. • Ongoing review of the controls framework to support the security of emerging technologies, including artificial intelligence (AI) and generative AI (GenAI), ensuring alignment with evolving risks and regulatory expectations.


text: There can be no assurance that our and our third-party service providers', strategic partners', contractors', consultants', and collaborators' cybersecurity risk management program and processes, including policies, controls, or procedures, will be fully implemented, complied with, or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives at least quarterly reports from our Chief Digital & Technology Officer and internal security staff on developments in our information technology infrastructure and cybersecurity program. This includes updates, as appropriate, on key information technology initiatives, new and existing cybersecurity risks, and how management is managing risks. In addition, the Chief Digital & Technology Officer updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant per our established severity and response framework.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program and an annual report from management on our cybersecurity risks.


text: Our security technology team, led by the Head of Core Technology & Security (Head of CT&S), is responsible for managing and directing day-to-day assessment and management of materials risks from cybersecurity threats, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Head of CT&S reports to our Chief Digital and Technology Officer. The Head of CT&S has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He is an ISACA certified security manager and has over 20 years of experience in information technology, with over 10 years specifically focused on cybersecurity risk management.


text: Our management takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Immuneering Corp

ticker: IMRX


text: We design and assess our cybersecurity risk management program based in part on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not, nor is it in any way intended to, imply that we currently or may in the future meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and/or financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, potential products, services, and our broader enterprise IT environment; • a cyber security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, as we believe appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • risk management processes with respect to third party service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management is tasked with updating the Audit Committee, if and as necessary, regarding any material cybersecurity incidents, as well as other incidents with lesser impact potential.


text: The Audit Committee periodically reports to the full Board of Directors regarding its activities, which may include those related to cybersecurity. The full Board of Directors may also from time to time receive briefings from management related to our cyber risk management program. Directors may receive presentations on cybersecurity topics from our management, internal cyber security / information technology staff, or external experts as part of continuing education on topics that impact public companies.


text: Our management team, including our Executive Director of IT with supervision by our Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and external cybersecurity consultants. Our Executive Director of IT has previous experience managing information technology infrastructure and cybersecurity, as well as responding to cybersecurity incidents, at other biopharmaceutical companies.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: TriplePoint Private Venture Credit Inc.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, manage the Company's cybersecurity program. The CCO of the Company oversees the Company's oversight function generally and relies on the Adviser's technology team to assist with assessing and managing material risks from cybersecurity threats. The CCO has been responsible for this oversight function as CCO of the Company for one year and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats and cybersecurity incidents. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cybersecurity risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting or which are reasonably likely to impact the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, manage the Company's cybersecurity program. The CCO of the Company oversees the Company's oversight function generally and relies on the Adviser's technology team to assist with assessing and managing material risks from cybersecurity threats. The CCO has been responsible for this oversight function as CCO of the Company for one year and has worked in the financial services industry for more than 30 years, during which time our CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Our process for identifying, assessing and managing material risks from cybersecurity threats is part of our broader risk management system and processes. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our offerings, infrastructure and corporate resources. As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits and risk assessments. We also maintain a variety of incident response plans, playbooks and processes that are utilized if and when incidents are detected.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: In addition, we have processes in place to govern our third-party vendor security risks. We generally gather information, usually through questionnaires, from certain third parties who contract with the Company and receive sensitive data from us or have access to or integrate with our systems, in order to help us assess potential risks associated with their security processes. We also generally require third parties to, among other things, maintain security controls to protect confidential information and data, and generally notify us of any data breaches that may impact our data through obligations that are documented in data processing or other agreements. We also carry insurance that provides certain, limited protection against losses arising from a cybersecurity incident.


text: Internally, we also have a security awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. These trainings are mandatory for all employees and take place throughout the year, and it is supplemented by testing initiatives, including periodic phishing tests. We also provide access to specialized training for certain employee roles, such as application developers. Finally, our privacy and data protection program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: From time to time, we engage assessors, consultants, auditors, or other third-party service providers to enhance risk mitigation efforts. For instance, we periodically perform simulations and tabletop exercises for our technical teams and senior leaders to prepare for a possible cyber crisis and incorporate external resources and advisors as needed. We also engage third-party consultants and service providers to assist with penetration testing, security audits and vulnerability assessments in certain jurisdictions.


text: While our full Board has overall responsibility for risk oversight and is currently overseeing our business continuity, regulatory and compliance risks, it is supported in this function by our Audit Committee, Compensation Committee and NCG Committee. Our Audit Committee periodically reviews our cybersecurity, information technology, data protection, privacy and compliance risk management, as well as performs other risk oversight functions. Through its regular meetings with management, including the accounting and finance, legal, internal audit, regulatory compliance and information technology and security functions, the Audit Committee reviews and discusses our cybersecurity risk management practices and policies and periodically updates the Board or relevant members or committees thereof, about any material risks and the appropriate mitigating factors.


text: Our Chief Information Officer, who has information technology, engineering, product and security knowledge, experience and skills gained over a decade of experience leading product and engineering organizations, and certain members of his team as well as outside advisors who have cybersecurity experience are responsible for implementing and maintaining cybersecurity and data protection practices at the Company and reporting on cybersecurity matters to the relevant members of management. This team is supported, from time to time, by third-party consultants and service providers with specific areas of cybersecurity expertise. Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Management also regularly communicates cybersecurity risks and activities with other members of management and, as appropriate, to our Board or relevant members or committees thereof, including the Audit Committee.


text: We, like many other companies in the gaming and entertainment space, experience routine cybersecurity threats such as DDOS, phishing or social engineering attacks. While our business strategy, results of operations and financial condition have not been materially affected by risks from any such cybersecurity threats, including as a result of previously identified cybersecurity incidents, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: In addition, we have processes in place to govern our third-party vendor security risks. We generally gather information, usually through questionnaires, from certain third parties who contract with the Company and receive sensitive data from us or have access to or integrate with our systems, in order to help us assess potential risks associated with their security processes. We also generally require third parties to, among other things, maintain security controls to protect confidential information and data, and generally notify us of any data breaches that may impact our data through obligations that are documented in data processing or other agreements. In addition, we carry insurance that provides certain, limited protection against losses arising from a cybersecurity incident.


text: Internally, we have a security awareness program, which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. These trainings are mandatory for all employees and take place throughout the year, and it is supplemented by testing initiatives, including periodic phishing tests. We also provide access to specialized training for certain employee roles, such as application developers. Finally, our privacy and data protection program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: Our Chief Information Officer, who has information technology, engineering, product and security knowledge, experience and skills gained over a decade of experience leading product and engineering organizations, our Chief Information Security Officer, who also has over two decades of cybersecurity experience in both public and private organizations, and certain members of their teams as well as outside advisors who have cybersecurity experience are responsible for implementing and maintaining cybersecurity and data protection practices at the Company and reporting on cybersecurity matters to the relevant members of management. This team is supported, from time to time, by third-party consultants and service providers with specific areas of cybersecurity expertise. Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Management also regularly communicates cybersecurity risks and activities with other members of management and, as appropriate, to our Board or relevant members or committees thereof, including the Audit Committee.


text: We, like many other companies in the gaming and entertainment space, including some of our market access partners and suppliers, experience routine cybersecurity threats such as DDOS, phishing or social engineering attacks. While our business strategy, results of operations and financial condition have not been materially affected by risks from any such cybersecurity threats, including as a result of previously identified cybersecurity incidents, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Commitment to Security Security is a foundation on which ZoomInfo builds and maintains customers' trust. We are committed to protecting our information and our customers' information from both intentional and unintentional misuse and have implemented a robust Information Security Management System ("ISMS") that meets the ISO 27001 Standard requirements as well as the ISO 27701 (Privacy) and ISO 27017 (Cloud Security) standards. We have also earned AICPA's SOC 2 attestation regarding the security, availability, and confidentiality controls around our services and meet the security requirements of the Cloud Security Alliance (CSA) STAR program.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Risk Management Framework Our security program is risk-driven and integrated into our overall enterprise risk management (ERM) process. We emphasize risk detection, which serves as the foundation for risk management-related business decisions. Our ISMS provides the structure for our overall security program and serves to assess, manage, monitor, and minimize our cybersecurity risks. The program includes: • Context of the organization • Leadership • Planning • Support • Operation • Performance evaluation • Improvement


text: The ISMS consists of a set of policies and procedures that serve as a foundation for risk identification and remediation across all company assets. ZoomInfo's ISMS implementation allows for the appropriate integration of security controls into existing or newly created business processes. ZoomInfo's risk management platform is based on the ISO 31000 Risk Management Standard, and continuous risk assessment activities are conducted in partnership and coordination with risk owners in various functions.


text: Team and Internal Operations Our Cybersecurity team is comprised of a diverse group of security veterans with experience managing all facets of information risk including, but not limited to, Application Security, Data Governance, Security Engineering, Security Processes and Services, Secure Software Development (S-SDLC), Governance Risk and Compliance (GRC), Risk Management, Cyber Threat Intelligence, Breach Readiness, Cyber Defense Center for monitoring (CDC), Offensive Security, and Security Awareness.


text: We also consult with outside experts to identify and implement best practices, help gauge the security climate, and identify effective methods for related skill development and information sharing.


text: Our information security policies outline the roles and responsibilities within the organization, and our security team works directly with specific members of senior management we call "security ambassadors" to help ensure that the various information security directives are executed as required in their respective departments. Our security partners help to establish, assess, and enhance business processes by ensuring the required information security risk management practices are suitably embedded within their respective processes.


text: All employees and contractors are required to participate in continuous and dynamic security awareness training. The training includes an overview of key security topics, policies, and responsibilities. Regular security bulletins are disseminated to employees and contractors with security alerts, tips and best practices, external resources, security procedures, and contact information so that they can ask security-related questions or raise concerns.


text: Prevention, Detection, and Response ZoomInfo has implemented preventative security and detection measures, including asset protection and access controls in the following key areas: • Critical Assets • Data Protection • Application Protection • Cloud Security • Network Security • End Point Devices • Perimeter Defense • Physical Protection We also maintain written incident response plans and conduct periodic cross-functional tabletop exercises to help assess our incident response plans, processes, and capabilities in addressing cybersecurity threats.


text: As part of our security framework and evaluation of our supply chain risks, we review our service providers' security practices and require appropriate certifications from them. We, and also perform an analysis of controls to manage our third-party security risks.


text: Cybersecurity Risks For information related to whether risks from cybersecurity threats have materially affected or are reasonably likely to materially affect ZoomInfo, see "Risk Factors—Cyber-attacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Oversight of Risk Management Generally Our Board has extensive involvement in the oversight of risk management related to us and our business. The Board accomplishes this oversight both directly and through its Audit Committee, Compensation Committee, Nominating and Corporate Governance Committee, and Privacy, Security and Technology Committee, each of which assists the Board in overseeing a part of our overall risk management and regularly reports to the Board. The Audit Committee represents the Board by periodically reviewing our accounting, reporting and financial practices, including the integrity of our financial statements, the oversight of administrative and financial controls, our compliance with legal and regulatory requirements and our policies with respect to risk assessment and risk management. Through its regular meetings with management, including the finance, legal and internal audit functions, the Audit Committee reviews and discusses significant areas of our business and related risks and summarizes for the Board areas of risk and any mitigating factors. The Compensation Committee considers, and discusses with management, management's assessment of certain risks, including whether any risks arising from our compensation policies and practices for our employees are reasonably likely to have a material adverse effect on us. The Nominating and Corporate Governance Committee oversees and evaluates programs and risks associated with Board organization, membership and structure, succession planning and corporate governance. In addition, our Board receives periodic detailed operating performance reviews from management. The Privacy, Security and Technology Committee, represents the Board by periodically reviewing and discussing with Company management the Company's major risk exposures relating to privacy, cybersecurity, and technology, and the steps the Company takes to detect, monitor, and actively manage such exposures.


text: Board Oversight of Privacy, Cybersecurity and Technology Risks Our Board recognizes the importance of maintaining the trust and confidence of our customers and employees. As a part of its independent oversight of the key risks facing our company, the Board, primarily through its Privacy, Security and Technology Committee, devotes significant time and attention to the oversight of privacy, cybersecurity, and technology risks. The Privacy, Security, and Technology Committee oversees management's approach to staffing, policies, processes, and practices to gauge and address privacy, cybersecurity, and technology risks. The Privacy, Security, and Technology Committee regularly reports to the full Board and discusses the significant privacy, cybersecurity, and technology issues at the Board level.


text: Our cybersecurity program is managed by our chief security officer ("CSO"). Our CSO is informed about and monitors awareness, prevention, detection, mitigation, and remediation efforts through regular communication and reporting from members of the information security team. Our CSO has served in information security roles for over 20 years, including serving as the Chief Information Security Officer for technology organizations and a government defense agency. He holds a masters degree in information systems and an undergraduate degree in electrical engineering. In addition, our chief technology officer ("CTO") has served in various leadership roles in information technology, engineering, and product management for over 25 years at public and private technology companies. He holds a PhD in computer science and undergraduate and masters degrees in computer engineering.


text: Our chief compliance officer, CTO, general counsel, and other members of management are part of an executive-level Security Steering Committee chaired by our CSO, along with subcommittees comprised of cross-functional representatives focused on evaluating ZoomInfo's data governance, cybersecurity incident response framework, security culture, and product and application security, among other areas. Members of the executive-level Security Steering Committee provide updates and analysis regarding cybersecurity, data privacy, and related security topics to the Board's Privacy, Security, and Technology Committee at each meeting. In addition, our legal, privacy, and compliance teams are focused on applicable cybersecurity laws and regulations and monitor changes to such laws and regulations with a view to implementing what we believe are best practices in the industry.


text: Commitment to Security Security is a foundation on which ZoomInfo builds and maintains customers' trust. We are committed to protecting our information and our customers' information from both intentional and unintentional misuse and have implemented a robust Information Security Management System ("ISMS") that meets the ISO 27001 Standard requirements as well as the ISO 27701 (Privacy) and ISO 27017 (Cloud Security) standards. We have also earned AICPA's SOC 2 attestation regarding the security, availability, and confidentiality controls around our services and meet the security requirements of the Cloud Security Alliance STAR program.


text: Risk Management Framework Our security program is risk-driven and integrated into our overall enterprise risk management process. We emphasize risk detection, which serves as the foundation for risk management-related business decisions. Our ISMS provides the structure for our overall security program and serves to assess, manage, monitor, and minimize our cybersecurity risks. The program includes: • Context of the organization • Leadership • Planning • Support • Operation • Performance evaluation • Improvement


text: The ISMS consists of a set of policies and procedures that serve as a foundation for risk identification and remediation across all company assets. ZoomInfo's ISMS implementation allows for the appropriate integration of security controls into existing or newly created business processes. ZoomInfo's risk management platform is loosely based on the ISO 31000 Risk Management Standard, and continuous risk assessment activities are conducted in partnership and coordination with risk owners in various functions.


text: Team and Internal Operations Our cybersecurity team is comprised of a diverse group of security veterans with experience managing all facets of information risk including, but not limited to, Application Security, Data Governance, Security Engineering, Security Processes and Services, Secure Software Development, Governance Risk and Compliance, Risk Management, Cyber Threat Intelligence, Breach Readiness, Cyber Defense Center for monitoring, Offensive Security, and Security Awareness.


text: As part of our security framework and evaluation of our supply chain risks, we review our service providers' security practices and require appropriate certifications from them. We also perform an analysis of controls to manage our third-party security risks.


text: Oversight of Risk Management Generally Our Board has extensive involvement in the oversight of risk management related to us and our business. The Board accomplishes this oversight both directly and through its Audit Committee, Compensation Committee, Nominating and Corporate Governance Committee, and Privacy, Security and Technology Committee, each of which assists the Board in overseeing a part of our overall risk management and regularly reports to the Board. The Audit Committee represents the Board by periodically reviewing our accounting, reporting and financial practices, including the integrity of our financial statements, the oversight of administrative and financial controls, our compliance with legal and regulatory requirements and our policies with respect to risk assessment and risk management. Through its regular meetings with management, including the finance, legal and internal audit functions, the Audit Committee reviews and discusses significant areas of our business and related risks and summarizes for the Board areas of risk and any mitigating factors. The Compensation Committee considers, and discusses with management, management's assessment of certain risks, including whether any risks arising from our compensation policies and practices for our employees are reasonably likely to have a material adverse effect on us. The Nominating and Corporate Governance Committee oversees and evaluates programs and risks associated with Board organization, membership and structure, succession planning and corporate governance. In addition, our Board receives periodic detailed operating performance reviews from management. The Privacy, Security and Technology Committee represents the Board by periodically reviewing and discussing with Company management the Company's major risk exposures relating to privacy, cybersecurity, and technology, and the steps the Company takes to detect, monitor, and actively manage such exposures.


text: Board Oversight of Privacy, Cybersecurity and Technology Risks Our Board recognizes the importance of maintaining the trust and confidence of our customers and employees. As a part of its independent oversight of the key risks facing our company, the Board, primarily through its Privacy, Security and Technology Committee, devotes significant time and attention to the oversight of privacy, cybersecurity, and technology risks. The Privacy, Security, and Technology Committee oversees management's approach to controls, policies, processes, and practices to gauge and address privacy, cybersecurity, and technology risks. The Privacy, Security, and Technology Committee regularly reports to the full Board and discusses the significant privacy, cybersecurity, and technology issues at the Board level.


text: Our cybersecurity program is managed by our chief information security officer ("CISO"). Our CISO is informed about and monitors awareness, prevention, detection, mitigation, and remediation efforts through regular communication and reporting from members of the information security team. Our CISO has served in global information security roles for over 20 years, including serving as the Chief Information Security Officer for a leading cloud-based security company and other organizations. In addition, our chief information officer ("CIO") has served in various leadership roles in the information technology field and has over 25 years of experience across multiple industries, including at adTech, semiconductor, consumer electronics, retail, software, and data companies.


text: Our CISO, CIO, chief technology officer, general counsel, and other members of management are part of an executive-level Security Steering Committee, along with subcommittees comprised of cross-functional representatives focused on evaluating ZoomInfo's data governance, cybersecurity incident response framework, security culture, and product and application security, among other areas. Members of the executive-level Security Steering Committee provide updates and analysis regarding cybersecurity, data privacy, and related security topics to the Board's Privacy, Security, and Technology Committee at each meeting. In addition, our legal, privacy, and compliance teams are focused on applicable cybersecurity laws and regulations and monitor changes to such laws and regulations with a view to implementing what we believe are best practices in the industry.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our internal and customer facing IT Systems and Confidential Information.

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: We have designed our program taking into account the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and Center For Internet Security ("CIS") Controls. These standards, along with other industry benchmarks, such as the PCI DSS, are used as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business, but this does not imply that we meet any particular technical standards, specifications, or requirements at all times.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our enterprise risk assessment function, which is led by our General Counsel and Vice President of Internal Audit, we have implemented processes to assess, identify and manage the material risks facing the Company, including from cyber threats. As part of this process, our IT organization assesses cybersecurity risk and evaluates our policies, procedures, skill sets and tools, with the aim to identify and address, as appropriate, areas of vulnerability. Our internal audit team performs testing to assess whether our program is appropriately designed and operating as intended.


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our IT Systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • designing products and services built with security tools; • cybersecurity awareness training, including internal phishing tests of our employees, contractors, consultants, or any third-parties who will have access to our IT Systems, information, products, services, or our broader enterprise IT environment; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on their criticality and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. See "Risk Factor–Our inability to protect our IT Systems and Confidential Information from continually evolving cybersecurity risks, security breaches or other technological risks could affect our reputation and brand among our merchants and consumers and may expose us to material financial penalties and legal liability."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks and program. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team, including the Director of Enterprise Security & Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel. Our management team's collective experience includes a diverse background in fintech and other industries, with decades of experience in various aspects of cybersecurity.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our internal and customer facing IT Systems and Confidential Information.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our enterprise risk assessment function, which is led by our General Counsel and Vice President of Internal Audit, we have implemented processes designed to assess, identify and manage the material risks facing the Company, including from cybersecurity risks. As part of this process, our IT organization assesses cybersecurity risk and evaluates our policies, procedures, skill sets and tools, with the aim to identify and address, as appropriate, areas of vulnerability. Our internal audit team performs testing to assess whether our program is appropriately designed and operating as intended.


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our IT Systems and Confidential Information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • designing products and services with cybersecurity in mind; • cybersecurity awareness training, including internal phishing tests of our employees, contractors, consultants, or any third-parties who will have access to our IT Systems, information, products, services, or our broader enterprise IT environment; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on their criticality and risk profile.


text: Our management team, including the VP of Enterprise Security & Compliance and Director of Enterprise Security & Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel. Our management team's collective experience includes a diverse background in fintech and other industries, with decades of experience in various aspects of cybersecurity.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. In addition, our VP of Enterprise Security & Compliance and Director of Enterprise Security & Compliance brings extensive expertise in risk assessment and management, regulatory compliance (including PCI DSS, GDPR, and the Sarbanes-Oxley Act), incident response, data protection and privacy, security monitoring and threat intelligence, and the implementation of advanced security technologies.


text: Our security program is designed to reflect our business objectives, meet relevant laws and regulations, prevent unauthorized use of or access to our information systems, and maintain information assets' confidentiality, integrity, and availability. Our policies and processes are guided by security requirements specific to our operating environment, laws, and regulations that are relevant to us and information security best practices.

companyName: SelectQuote, Inc.

ticker: SLQT


text: The Company's cybersecurity strategy includes recognition and deployment of the following: a. A formal approach to enterprise risk management encompassing finance, operational risk management, and Information Technology ("IT") to manage the business and technology-related challenges and required regulatory compliance obligations i. Board approved Information Security policies that are reviewed bi-annually ii. An IT infrastructure architecture that has been designed and implemented with security at its core in order to enable key business activities while ensuring the confidentiality, integrity, and availability of our technology infrastructure and critical business and customer data. The Network Security Architecture design focuses on our ability to: i. Identify and understand organizational risks to critical systems, assets, data & capabilities ii. Protect our environment by putting in safeguards iii. Detect potential threats by developing and implementing the appropriate activities to identify the occurrence of a cybersecurity event iv. Respond to and take the appropriate action regarding a detected cybersecurity incident v. Recover and restore any capabilities or services that were impaired due to a cybersecurity incident To reduce the risks from cybersecurity threats associated with our use of third-party service providers, we have a supplier relationship policy and process which outlines information security requirements for mitigating the risks associated with supplier's access to our organization's assets. This policy must be agreed to by the supplier, documented, and reviewed annually.


text: SelectQuote has a network of third-party, industry leading, security experts whom they engage to independently test, assess and evaluate our risk management practices. We routinely engage in risk management activities designed to identify potential vulnerabilities; which, if identified, are planned for remediation.


text: Day to day management of our cybersecurity program is the responsibility of the Director, Information Technology Security. The Director manages an internal team of security professionals, as well as a third-party managed security operations center which provides 24/7 security monitoring. Our Director of IT Security reports to the Chief Information Officer. The two, combined, have over 50 years of experience in the information technology field and 30 years in IT security.


text: Our Board of Directors recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board of Directors has oversight responsibilities for risk management with a focus on the most significant risks facing us, including strategic, operational, financial and legal compliance risks. The Board's risk oversight process builds upon management's risk assessment and mitigation processes, which include an enterprise risk management program of which our cybersecurity processes are an integral component.


text: Our Board implements its risk oversight function both as a board and through delegation to board committees, which meet regularly and report back to the Board, including delegating oversight of specific risks to board committees that align with their functional responsibilities. Our Audit Committee assists the Board in overseeing the enterprise risk management program and evaluates and monitors risks related to, among other things, the company's information security program. Our Audit Committee assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Our Chief Information Officer and Director of Information Technology Security periodically attend meetings and provide quarterly cybersecurity updates to the Audit Committee, and as needed, to the Board.


text: Our Chief Information Officer and Director of IT Security report directly to the Audit Committee of the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues at least once annually or more frequently as determined to be necessary or advisable. In addition, we have an escalation process in place to inform senior management and the Board of Directors when it is appropriate under the circumstances.


text: We, like any company, have experienced cybersecurity incidents in the past. However, as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents which have been determined to be material. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business, operating results and financial condition, please refer to Part I, Item 1A, Risk Factors, in this Annual Report on Form 10-K.


text: The Company's cybersecurity strategy includes recognition and deployment of the following: a. A formal approach to enterprise risk management encompassing finance, operational risk management, and Information Technology ("IT") to manage the business and technology-related challenges and required regulatory compliance obligations i. Board approved Information Security policies that are reviewed annually ii. An IT infrastructure architecture that has been designed and implemented with security at its core in order to enable key business activities while ensuring the confidentiality, integrity, and availability of our technology infrastructure and critical business and customer data. The Network Security Architecture design focuses on our ability to: i. Identify and understand organizational risks to critical systems, assets, data & capabilities ii. Protect our environment by putting in safeguards iii. Detect potential threats by developing and implementing the appropriate activities to identify the occurrence of a cybersecurity event iv. Respond to and take the appropriate action regarding a detected cybersecurity incident v. Recover and restore any capabilities or services that were impaired due to a cybersecurity incident To reduce the risks from cybersecurity threats associated with our use of third-party service providers, we have a supplier relationship policy and process which outlines information security requirements for mitigating the risks associated with supplier's access to our organization's assets. This policy must be agreed to by the supplier, documented, and reviewed annually.


text: We maintain a cybersecurity program that is reasonably designed to protect our information, and that of our clients, portfolio companies and investment managers with which we conduct business, against cybersecurity threats that may result in significant adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: StepStone Group Inc.

ticker: STEP


text: Board of Directors The board of directors oversees our processes for assessing and managing risk. Our audit committee is responsible for reviewing and discussing our practices with respect to risk assessment and risk management, including risks related to information technology and cybersecurity. The board of directors and audit committee periodically review the measures implemented by us to identify and mitigate risks from cybersecurity threats. As part of such reviews, the board of directors and audit committee receive reports and presentations from those responsible for overseeing our cybersecurity risk management, including the Managing Director, Head of Information Technology ("Head of IT") and our Legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers, industry participants, service providers and other third parties. The Head of IT also periodically presents to the board of directors and audit committee, including to describe our information security infrastructure and improvements made, and to report on any significant developments. From time to time, external legal advisers provide education to the board of directors and/or audit committee in respect of information security related developments and to provide training in respect of directors' responsibilities. We have a framework under which certain cybersecurity incidents are escalated and, where appropriate, reported to the board of directors or audit committee in a timely manner.


text: We have a cybersecurity working group composed of members of the Information Technology (including Information Security), Legal and Compliance departments, including the Head of IT, Chief Legal Officer, Chief Compliance Officer, and a number of their respective team members. The working group meets regularly to identify and mitigate data protection and cybersecurity risks, implement information security governance mechanisms, discuss developments in information security, and discuss and respond to any significant cyber incidents. The working group is expected to escalate matters of significance to our Incident Response Team, ERMC (defined below) and/or the disclosure committee, as appropriate.


text: We have adopted an Incident Response Plan ("IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process leverages the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all personnel, networks and systems, third-party systems and end-user devices.


text: In addition, we have an Enterprise Risk Management Committee ("ERMC") composed of a number of members of senior management from operations across our businesses, legal, compliance, information technology, finance, human resources and internal audit and risk. The ERMC was established to oversee and promote the efficient and effective management of our enterprise risks. Cybersecurity and significant information security matters are to be brought before the ERMC or certain of its members, and matters of primary significance are to be further escalated and reported to our Global Executive Committee and the audit committee of our board of directors, as appropriate.


text: At the management level, the Head of IT, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices and reports directly to the President and Co-Chief Operating Officer. The Head of IT receives reports on cybersecurity threats from his team and external service providers on an ongoing basis and, in conjunction with management, reviews risk management measures implemented by us to identify and mitigate data protection and cybersecurity risks. The Head of IT works closely with our Legal and Compliance departments to oversee compliance with legal, regulatory and contractual security requirements and to develop reports and presentations to the board of directors and its audit committee. The Head of IT is responsible for providing training to employees in respect of information security.


text: We take a multifaceted approach to managing risk from cybersecurity threats. Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats in a timely manner. Our information security program and supporting policies apply to all employees, contractors and certain vendors servicing the firm. The program outlines the development, maintenance, and distribution of information security policies and procedures that detail the implementation and maintenance of the information security program and its safeguards, and cover various areas such as information handling, user access management, encryption, data retention and backups, computer and network security and monitoring, physical security, incident reporting and response, service provider oversight, and employee and contractor use of technology. We also undergo annual SOC 1 Type 2 testing of our financial processes and supporting technical controls. In addition to the foregoing, we conduct regular employee trainings on cybersecurity and perform phishing exercises to test employees' understanding of how to identify social engineering attacks. We perform diligence, including in respect of information security, of vendors and third parties with significant access to confidential information and personal data, and periodically monitor such vendors. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems. We conduct annual penetration testing performed by a rotating group of third-party security firms to test our technical controls and security response. Our internal audit team has also conducted a cybersecurity assessment to test our preparedness. In addition to our internal cybersecurity capabilities and third-party penetration testing, we also, at times, engage consultants or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. To date, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Cybersecurity risks and cybersecurity incidents could adversely affect our business by causing a disruption to our operations, which could adversely affect our financial condition and results of operations.", which should be read in conjunction with the foregoing information.


text: Board of Directors The board of directors oversees our processes for assessing and managing risk. Our audit committee is responsible for reviewing and discussing our practices with respect to risk assessment and risk management, including risks related to information technology and cybersecurity. The board of directors and audit committee periodically review the measures implemented by us to identify and mitigate risks from cybersecurity threats. As part of such reviews, the board of directors and audit committee receive reports and presentations from those responsible for overseeing our cybersecurity risk management, including the Partner, Chief Information Security Officer & Head of Information Technology ("CISO") and our Legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers, industry participants, service providers and other third parties. The CISO also periodically presents to the board of directors and audit committee, including to describe our information security infrastructure and improvements made, and to report on any significant developments. From time to time, external legal advisers provide education to the board of directors and/or audit committee in respect of information security related developments and to provide training in respect of directors' responsibilities. We have a framework under which certain cybersecurity incidents are escalated and, where appropriate, reported to the board of directors or audit committee in a timely manner.


text: We have a cybersecurity working group composed of members of the Information Technology (including Information Security), Legal and Compliance departments, including the CISO, Chief Technology Officer, Chief Legal Officer, Chief Compliance Officer, and a number of their respective team members. The working group meets regularly to identify and mitigate data protection and cybersecurity risks, implement information security governance mechanisms, discuss developments in information security, and discuss and respond to any significant cyber incidents. The working group is expected to escalate matters of significance to our Incident Response Team, ERMC (defined below) and/or the disclosure committee, as appropriate.


text: At the management level, the CISO, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices and reports directly to the President and Co-Chief Operating Officer. The CISO receives reports on cybersecurity threats from his team and external service providers on an ongoing basis and, in conjunction with management, reviews risk management measures implemented by us to identify and mitigate data protection and cybersecurity risks. The CISO works closely with our Legal and Compliance departments to oversee compliance with legal, regulatory and contractual security requirements and to develop reports and presentations to the board of directors and its audit committee. The CISO is responsible for providing training to employees in respect of information security.


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. To date, based on information available as of the date of this annual report, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect and there can be no assurance that we will not be subject to future cybersecurity attacks, threats or incidents that may materially affect our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Cybersecurity risks and cybersecurity incidents could adversely affect our business by causing a disruption to our operations, which could adversely affect our financial condition and results of operations.", which should be read in conjunction with the foregoing information.


text: Cyber Security Plan We have implemented various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature (including without limitation tenant and property related data) ("Information Systems and Data").

companyName: NETSTREIT Corp.

ticker: NTST


text: Our information security processes are overseen by our IT Manager and our Chief Accounting Officer, and supported by a cybersecurity monitoring service provider, who work to help identify, assess and manage the Company's cybersecurity threats and risks. Our IT Manager, as well as our service provider, work to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging a third-party vendor to audit our security protocols in certain systems, and deploying automated monitoring tools across certain systems. Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, risk assessments, network security controls for certain environments, periodic back-ups of certain data, access controls for certain environments, employee training addressing awareness of cyber risks and how to detect certain cyberattacks, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is integrated into the Company's overall risk management processes, which includes an assessment of risks posed to data that is critical to our business operations (e.g., to support financial reporting, process payroll, and collect and maintain property and lease information).


text: Third Party Risk Management The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example a managed service security provider that monitors certain of the Company's computer networks and third-party hosted services.


text: We use third-party service providers to perform a variety of functions throughout our business, including application providers and hosting companies. The Company has implemented certain measures designed to help identify and mitigate cybersecurity threats associated with the use of third-party service providers, such as assessing the security protocols of certain service providers and obtaining security reports from certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K. Any material failure, weakness, interruption or breach in security of our information systems or data, or those of our third party vendors, could prevent us from effectively operating our business.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Manager, who has worked in various roles responsible for securing networks, hardware and other application systems, Chief Financial Officer, and Chief Accounting Officer.


text: Our Chief Financial Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including senior management. The Company has identified and designated certain Company employees as members of a cybersecurity incident response team, including the Chief Accounting Officer and the IT Manager. This team helps the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee of the board of directors receives quarterly reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. These quarterly reports include summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Cyber Security Plan We have implemented various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature (including without limitation tenant and property related data) ("Information Systems and Data").


text: Our information security processes are overseen by our IT Manager, Chief Accounting Officer, and Chief Financial Officer, and are supported by a cybersecurity monitoring service provider, who works to help identify, assess, and manage the Company's cybersecurity threats and risks. Our IT Manager, as well as our service provider, work to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example, subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging a third-party vendor to audit our security protocols in certain systems, and deploying automated monitoring tools across certain systems. Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, risk assessments, network security controls for certain environments, periodic back-ups of certain data, access controls for certain environments, employee training addressing awareness of cyber risks and how to detect certain cyberattacks, and cybersecurity insurance.


text: Third Party Risk Management The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, a managed service security provider that monitors certain of the Company's computer networks and third-party hosted services.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including Any material failure, weakness, interruption, or breach in security of our information systems or data, or those of the third parties with whom we work, could prevent us from effectively operating our business.