text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over fifteen years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company for ten years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser and FS Investments.

companyName: FS KKR Capital Corp

ticker: FSK

secItem: Item 1C


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Risk Management and Strategy CRH leverages its Enterprise Risk Management (ERM) framework, which accords with internationally recognized standards, to identify, assess, respond, monitor and report material cybersecurity risks facing the Company. CRH manages cybersecurity risk at multiple levels within the Company. Given CRH's wide geographic spread, the frequency and possible scale of acquisition activity, the diversity of the types of IT systems operated by CRH companies and the decentralized nature of its operations, CRH implements an amalgam of centralized and decentralized processes for IT management. Under this model, Company-level management and the management of CRH's operating companies and business units share responsibility for cybersecurity management and collaborate on assessing, identifying, and managing material risks.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: CRH's operating companies and business units use a variety of tools and processes to identify and manage material cybersecurity risks. CRH utilizes multiple monitoring tools and practices to identify and detect unusual activities and/or potential cybersecurity incidents, including potential system breaches, and to verify the effectiveness of protective measures. CRH's operating companies and business units implement various risk mitigation strategies, including continuously strengthening security measures, improving incident response plans through post-incident evaluations and assessments, investing in security technologies, providing regular and focused employee training, and transferring risk through cybersecurity insurance.


text: At the Group level, CRH conducts a semi-annual bottom-up risk assessment focused on CRH's operating companies and business units, including cybersecurity-related risks, which evaluates the impact and likelihood of the identified cyber risks and the effectiveness of existing security measures, policies, and procedures. CRH also requires that each operating company completes a self-assessment regarding its cyber controls and risk, including user awareness training, email security protection, multi-factor authentication, system patch management, identity management, network segregation, antivirus and web protections, asset inventory, privileged access management, logging, monitoring, and incident response capabilities. As described further below under "Cybersecurity Governance", CRH's Board and senior management receive regular briefings on cybersecurity risks facing CRH and are closely involved in identifying cybersecurity risks, developing CRH's plan for managing such risks, and continuously refining CRH's cyber defenses in response to the information gathered through the above-mentioned risk assessments.


text: To manage the risk of a material impact on CRH's operations or financial performance due to a cybersecurity incident, CRH has implemented a mandatory Cybersecurity Incident Escalation Standard as part of its Company-wide Information Security Policy. This Standard, which is supported by relevant guidelines and procedural documentation, provides a structured approach adapted to the systems of each CRH operating company and business unit to manage the incident response process through a series of pre-defined phases, including triage, containment, eradication, recovery, and post-incident analysis.


text: CRH also provides regular and focused training to aid employees in understanding and complying with relevant Company policies and applicable regulations, including those related to cybersecurity.


text: Assessment and management of cybersecurity risks is a key component of CRH's broader risk governance processes as cybersecurity is a core risk facing the Company. Identification of cybersecurity risks is integrated into CRH's overall ERM framework, with a focus on risks related to information systems, data security, operational technology and technology infrastructure.


text: CRH works closely with multiple external advisors specializing in cybersecurity to improve its ability to identify and detect, protect against, and recover from, cybersecurity incidents. In addition, CRH leverages certain managed service providers to aid in triaging and monitoring potentially malicious activities. CRH is dependent upon third-party service providers for certain IT-related services, and has systems of oversight to evaluate potential risks in certain critical third-parties on whom CRH has a material dependency. These systems would include the use of vendor security questionnaires, vulnerability assessments and annual audits.


text: CRH has not been subject to a cyber-attack that has had a material impact on our operations or financial results. For additional information, please refer to Item 1A. "Risk Factors".


text: Our Board is responsible for strategy, risk and governance, including oversight of risks from cybersecurity threats. The Board has delegated to the Audit Committee primary responsibility for oversight of cybersecurity risk management and the associated internal control systems. The Audit Committee is currently made up of six independent directors with a range of relevant cybersecurity, information technology and operational technology experience.


text: The Audit Committee receives updates at least annually from the Chief Information Security Officer (CISO) on the design and progress of key information security initiatives in addition to regular briefings on cybersecurity and management of cybersecurity-related risks from relevant members of management, including the Head of ERM and our CISO. Recent updates from the CISO have focused on the Company's information security strategy, ongoing security assessments and ongoing projects. The Audit Committee is responsible for updating the Board on identified risks related to cybersecurity.


text: Our Global Leadership Team is responsible for the execution of CRH's strategy and governance, including implementation and review of our ERM framework, which has identified cybersecurity as a core risk for CRH. CRH has established the role of CISO to provide technical leadership on a day-to-day basis in assessing and managing the Company's material cybersecurity risks and liaising with the chief information officers of CRH's Divisions. Our CISO has 25 years of experience working in IT, including more than a decade spent in prior technical and senior management roles related to cybersecurity. The divisional chief information officers have in excess of 20 years of experience, on average, in IT-related and cybersecurity-related roles and, together with the CISO, hold a variety of recognized and specialized credentials related to cybersecurity and IT.


text: CRH also maintains a Company-wide incident response function centered in our Group Information Security (GIS) team, led by the CISO. GIS responds to potential incidents across CRH in accordance with predetermined severity classifications. In line with CRH's Cybersecurity Incident Escalation Standard and supporting guidelines and procedural documentation, incidents that are deemed potentially material to the Company and/or which may lead to the exposure of confidential or sensitive data are immediately escalated to GIS for review and, as necessary, mitigation and remediation actions are taken. GIS and the CISO also review regular attestation reports that are required to be prepared by CRH's operating companies and business units regarding cybersecurity incidents that did not meet the threshold for immediate escalation.


text: Following cybersecurity incidents, GIS, in conjunction with members of management of CRH's operating companies and business units as necessary, conduct post-incident analysis and exercises designed to strengthen CRH's cybersecurity practices. The Risk Committee and Global Leadership Team are briefed on the occurrence, mitigation and remediation of cybersecurity incidents on a regular basis, including ad-hoc briefings covering significant or potentially material incidents.


text: The Risk Committee, which is made up of our Chief Financial Officer, Group General Counsel, Chief Operating Officer and the Divisional Presidents of CRH Americas and CRH International, is the executive oversight body for risk management, including cybersecurity risks and the work of the CISO, GIS and related teams. The Risk Committee meets quarterly with the Head of ERM to assess risks facing CRH, and, on an as-needed basis, meets with other members of CRH management regarding cybersecurity risks and developments. The Risk Committee also reviews the half-yearly risk updates that are provided to the Audit Committee prior to dissemination.


text: We recognize the critical importance of maintaining the safety and security of our information systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by our senior leadership team, the Audit Committee, and our Board of Directors.

companyName: APi Group Corp

ticker: APG


text: The responsibilities of the Chief Information Officer ("CIO") include overseeing cybersecurity measures with the global Chief Information Security Officer ("CISO "). The CIO's background includes nearly 19 years of IT leadership at a major medical technology company and experience in various industries such as financial services, manufacturing, oil and gas, and chemicals. He holds an undergraduate degree in Management Information Systems from Augsburg University and a Master of Business Administration from Carlson School of Management at the University of Minnesota.


text: The CISO, who reports to our CIO, is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. The CISO manages a team of professionals with broad cybersecurity experience and expertise. Our CISO has served in various roles in information technology and information security for over 20 years and holds an undergraduate degree in Information Systems from Xavier University and an MBA from Michigan State. The CISO and his regional security leaders have a combined total of over 25 Information Technology and Cybersecurity certifications, including Certified Information Systems Security Professional, Certified Cloud Security Professional, and Certified Information Security Manager.


text: The CISO and the cybersecurity team are committed to ongoing education and professional development, regularly participating in training programs and industry conferences to stay abreast of the latest cybersecurity trends, threats, and mitigation strategies.


text: The CISO has appointed experienced security leaders over the North American and International regions to create additional alignment and collaboration.


text: Our cybersecurity risk management program primarily leverages the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). We routinely assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our risk management program also assesses third party risks to attempt to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. As part of our cybersecurity risk management program, we also gather Threat Intelligence through our multiple security partners and tools. This intelligence (including tactics, techniques and procedures used by cyber criminals) provides insights into potential threats and vulnerabilities, which helps us to defend against cyber-attacks.


text: As part of our cybersecurity risk management system, our incident management teams track and log privacy and security incidents across the Company. Significant incidents are reviewed by a cross-functional and multi-disciplinary working group to determine whether further escalation is appropriate. Any cybersecurity incident that meets certain pre-established criteria is reported to our Executive Crisis Management Team ("ECMT"), which includes members of the Company's senior leadership team. The ECMT maintains an ongoing relationship with third-party advisors, such as forensic and incident management, crisis communications, and legal advisors, which we engage as necessary based on the specific facts of an incident. Incidents are evaluated to determine materiality for external reporting purposes as well as operational and business impact.


text: Assessment of our Program We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third parties. Our IT security team monitors alerts and meets as needed to discuss threat levels, trends, and remediation.


text: We periodically perform simulations and tabletop exercises with the senior leadership team and incorporate external resources and advisors as needed. As part of those tabletop exercises, we review our Executive Cyber Crisis Management Plan, which is intended to provide senior leadership with operational structure and key considerations in the event of a cybersecurity incident. We also conduct employee training for Cybersecurity through our online learning management systems, regular communications, and other interactive education, such as phishing simulations.


text: In addition, our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.


text: Our commitment to cybersecurity begins at the Board, includes our Audit Committee, and extends to our senior leaders across the company. Our Audit Committee oversees our enterprise risk management process. The Audit Committee's responsibilities include regular review of policies and practices with respect to risk assessment and risk management – including in the areas of cybersecurity and other information technology risk and privacy. The Audit Committee performs an annual review of the Company's cybersecurity program and reports to the Board on the results of that review. Material cybersecurity incidents are discussed with our Audit Committee and Board of Directors.


text: Cybersecurity Risk Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We face a multitude of increasing cybersecurity threats, including those that target the Nation's critical infrastructure sectors. Reliable service and operational continuity are critical to our success and the welfare of those we serve, including our ability to safely and reliably deliver energy to our customers through our transmission, distribution, and generation systems. We are committed to maintaining robust governance and oversight of these risks and to investing in the implementation of mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks in an evolving landscape.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: To mitigate the threat to our business, we take a comprehensive, cross-functional approach to cybersecurity risk management. Our management team is actively involved in the oversight and implementation of our risk management program, of which cybersecurity represents an important component. At least annually, we conduct a cybersecurity risk assessment that evaluates information from internal stakeholders and external sources. The results of the assessment inform our alignment and prioritization of initiatives to enhance our security controls. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are designed to follow nationally recognized frameworks. These include, among other things: security awareness training for employees; mechanisms to detect and monitor unusual network activity; services that identify cybersecurity threats; conducting scans of the threat environment; evaluating our industry's risk profile; utilizing internal and external audits; conducting threat and vulnerability assessments; and containment and incident response tools. We also actively engage with industry groups for benchmarking and awareness of best practices. We maintain controls and procedures that are designed for prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring: Our approach to cybersecurity involves multiple layers of defense, incorporating detection capabilities, analytics, and real-time monitoring. We utilize data insights to identify potential anomalies, monitor evolving threats, and identify emerging risks. Safeguards are regularly evaluated and refined based on vulnerability assessments, threat intelligence, and insights gained from monitoring activities. • Information Sharing and Collaboration: We share and receive threat intelligence with industry peers, government agencies, Information Sharing and Analysis Centers ("ISACs"), trade organizations, and cybersecurity forums. These collaborations provide a means for information exchange to improve threat detection and vulnerability mitigation. • Third-Party Risk Assessments: We engage independent firms to assist with multiple phases of our cybersecurity program. This work includes testing, audits, and consulting to validate and strengthen our cybersecurity posture, and the design and operational effectiveness of our controls. • Companywide Policies and Procedures: Our companywide cybersecurity policies and procedures cover areas such as encryption standards, endpoint security, remote access protocols, multi-factor authentication, and data protection. These policies undergo regular review to address the latest security standards and operational requirements, and to consider best practices and industry trends. • Training and Awareness: We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees routinely participate in simulated phishing campaigns, education that reinforces compliance with our policies, standards and practices, and other awareness training. We also periodically perform tabletops and other exercises with management and incorporate external resources and advisors as needed. Our cybersecurity team collaborates with stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies. • Supplier Engagement: We work collectively with our suppliers to support cybersecurity resiliency in our supply chain. The Company uses a variety of processes to address third-party cybersecurity threats, including reviewing the cybersecurity practices of such provider(s), contractually imposing obligations on the provider(s), notifications in the event of any known or suspected cyber incident, conducting security assessments, and periodic reassessments during the course of the Company's engagement with such provider(s).


text: As of the date of this Form 10-K, there have not been any cybersecurity incidents that have materially affected our business strategy, critical business operations, results of operations or financial condition. There can be no guarantee that our policies and procedures will be followed or, if followed, will be effective in protecting our systems and information. As such, this could impact, among other considerations, the execution of our business strategy and business operations, our financial condition and/or results of operations, and the security and effectiveness of our information technology systems. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, which should be read in conjunction with this Item 1C.


text: Cybersecurity Risk Governance and Oversight The Company's Board, in conjunction with its Audit Committee, oversees management's approach to cybersecurity risk and its alignment with the Company's enterprise risk management program. The Board and Audit Committee receive reports from Management regarding the prevention, detection, and mitigation of cybersecurity incidents, including security risks and vulnerabilities. Additionally, the Audit Committee receives updates on cybersecurity risk assessments, risk mitigation strategies, and relevant cybersecurity matters. The Company's information technology team is responsible for developing and implementing its information security program and reporting on cybersecurity matters to the Board of Directors and Audit Committee.


text: The Company's Risk Management Committee (RMC), which is chaired by the Chief Policy and Risk Officer, evaluates risks relating to cybersecurity, among other significant risks, and oversees mitigation plans. The RMC is comprised of executive leadership across multiple functions, including individuals with responsibilities and oversight over legal, regulatory, finance and treasury, operations, information technology, business development, and policies and controls. The RMC meets monthly and receives regular updates on security performance metrics, global security risks, security enhancements, and updates on our security posture.


text: The Company has a cross-functional cybersecurity incident response team ("CIRT"). The Company's CIRT routinely reviews and updates our incident response plans, procedures and protocols, as well as reports to the Company's RMC on security matters that impact the confidentiality, integrity, or availability of the Company's data or information systems.


text: Our industry is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations. While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See Item 1A, "Risk Factors," in this Annual Report on Form 10-K for additional information regarding the risks related to cybersecurity threats.

companyName: Marqeta, Inc.

ticker: MQ


text: Our Chief Information Security Officer ("CISO") is responsible for Marqeta's information security posture and cybersecurity program. We believe our CISO is qualified to assess and manage our material risks from cybersecurity threats based on over 15 years of cybersecurity and risk management expertise as a security and risk management leader at various public and private companies and as a cyber threat intelligence analyst for a branch of the United States military. Our CISO reports to our Chief Technology and AI Officer and oversees a team of cybersecurity professionals in areas including Governance, Risk, and Compliance, Product and Infrastructure Security, Security Operations, and Identity Security.


text: Our cybersecurity program is designed to align with certain industry standards and best practices, such as ISO 27001 and the National Institute of Standards and Technology Cybersecurity Framework. We have a Cyber Incident Response Plan which defines roles and responsibilities in the event of a cybersecurity incident, as well as the processes for keeping the CISO, senior management, and the board of directors informed about the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our CISO provides quarterly and as-needed briefings to the audit committee regarding cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third-party consultants. Our audit committee provides quarterly and as-needed updates to the board of directors on such reports and management provides annual and as-needed updates to the board of directors regarding our cybersecurity program.


text: We have policies and processes in place for assessing, identifying, and managing material cybersecurity risks, and integrate these processes into our overall risk management systems. We conduct periodic risk assessments to identify reasonably foreseeable internal and external cybersecurity risks, the criticality of such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we develop strategies, policies, standards, and action plans to minimize identified risks and reasonably address identified gaps in existing safeguards. These safeguards include vulnerability management, shift-left secure product design, data encryption, endpoint security, network security, limiting and authorizing access controls, and multi-factor authentication for access to systems with data. We also employ limited system monitoring, logging, and alerting to retain and analyze the security state of our corporate and production infrastructure. As part of our overall risk management system, all employees are required to complete annual cybersecurity training and relevant employees are trained at least annually on applicable safeguards.


text: We periodically engage consultants in connection with our risk assessment processes to help us design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We manage third party service providers using a risk-based approach intended to determine if the relevant third parties have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our business.


text: The maturation and scaling of our cybersecurity program is ongoing and despite our investments in our cybersecurity program, there will always be residual risk and the potential for control failure or bypass by a determined cyber threat actor.


text: Management has established policies and processes to identify, analyze, mitigate, and manage cybersecurity risks relevant to our platform, and has integrated these processes into the Company's overall risk management processes. Various types of risks are considered, including, but not limited to, fraud, technological, compliance, and vendor risks. Our program for assessing, identifying, and managing material risks from cybersecurity threats includes the following key controls: • To protect our systems and applications, we maintain endpoint security protection on all employee laptops and desktops, including industry-standard firewalls, monitoring, and intrusion detection practices. • We require multi-factor authentication to access our critical systems and applications. • We employ strong password standards for our systems and applications. We also employ firewalls across our infrastructure to guard against threats. • We provide ongoing security training to our employees and contractors about information security policies and practices, including phishing simulations. • Our process for managing third-party risk includes security assessments of key third-party service providers before entering into or renewing business with them or granting them access to our data or information systems. Additionally, we impose contractual restrictions on these providers based on their risk profile. • We maintain enterprise-wide policies and procedures for reporting and managing security incidents, including prompt reporting of all incidents. We perform incident response simulations on at least an annual basis.

companyName: Ibotta, Inc.

ticker: IBTA


text: We engage with independent third-party auditors to perform SOC2 assessments on an annual basis. We also engage with a third party to conduct penetration testing at least annually to identify threats and assess their potential impact to system security. Any vulnerabilities identified in this process are triaged by our information security team and handled in accordance with our vulnerability management process.


text: As of the date of this report, we have not experienced any cybersecurity incidents that have materially affected us, including our business strategy, results of operations, or financial condition. For certain risks from cybersecurity threats that may materially affect our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors," including the section titled, "If our security measures or information we collect and maintain are compromised or publicly exposed, publishers, CPG brands, retailers, and consumers may curtail or stop using our platform, and we could be subject to claims, penalties, and fines."


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.


text: Ou r Chief Technology Officer oversees our security team, which is responsible for our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The security team consists of experienced engineers and analysts. All senior members of the team have industry recognized accreditations or commensurate experience. Our security team meets at least weekly and holds quarterly meetings with cross-functional leadership to report on cybersecurity risks and threats.


text: Representatives from our security team provide quarterly updates to the Audit Committee and/or Board of Directors regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Our Board of Directors (the "Board") and management recognize the importance of maintaining the trust and confidence of our patients, investors, business partners and employees. The Board and our Audit Committee are actively involved in oversight of our cybersecurity program as part of our approach to risk management. Our cybersecurity policies, processes and practices are integrated into our operations and are based on recognized standards such as the National Institute of Standards and Technology Cybersecurity Framework. In general, we seek to address cybersecurity risks through a comprehensive, coordinated approach that is focused on preserving the confidentiality, security, and availability of the information that we create through our business operations by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: As one of the important elements that comprise and has been integrated into our overall enterprise risk management approach, our cybersecurity program includes the following:


text: As discussed in more detail below under the heading "Governance," our Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly reviews operational risks. Our Senior Director, IT Application & Compliance and Interim Head of Information Technology ("HIT"), together with our Head of Information Security ("HIS"), and other members of our management team meet regularly to review current cybersecurity risks. The HIT and management team representatives also meet with the Audit Committee at least on a quarterly basis to discuss and review our cybersecurity program and risk landscape.


text: Collaborative Approach: We have implemented a cross-functional approach involving all employees to help in identifying, preventing, and mitigating cybersecurity threats and incidents. We have implemented processes that provide for the prompt escalation of known cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by our management team, together with the Audit Committee, in a timely manner.


text: Technical Safeguards: We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, and access controls. We also employ multi-factor authentication and a managed endpoint detection and response solution for malware. These measures are evaluated and improved through vulnerability assessments and penetration testing completed by third party experts, as well as cybersecurity threat intelligence.


text: We have established and maintain an incident response plan that addresses our response to a cybersecurity incident. This plan is evaluated regularly.


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and third-party systems.


text: We provide regular training on cybersecurity threats to equip our personnel with effective tools to address them and to communicate our latest information security policies, processes and practices.


text: We periodically evaluate and test our policies, standards, processes, and practices to address cybersecurity threats and incidents. These efforts include a wide range of activities, including third party assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The results of such assessments and reviews are reported to our management team, the Audit Committee and the Board, and we adjust our cybersecurity program as necessary based on the information provided by these assessments and reviews.


text: Our Board, in coordination with the Audit Committee, oversees our risk management approach, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent expert reviews, the threat environment, technological trends, and any material risks identified with our third parties. The Audit Committee also receives prompt and timely information regarding any significant cybersecurity incidents, as well as ongoing updates regarding any such incidents until they have been remediated. Our HIT, Audit Committee and Board review and discuss our approach to cybersecurity risk on an annual basis.


text: The HIT and HIS, in coordination with our management team, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel, work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. Through an ongoing process, the HIS monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the HIT, management team, and when appropriate, the Audit Committee.


text: Selected Management and Director Qualifications The HIS and HIT have both served in various roles in information technology and information security for many years, including serving in similar roles at other publicly traded companies. The HIS holds several industry accreditations, including being a certified Chief Information Security Officer, and has worked in the information technology field for over 25 years, specializing in Information Security for the last 15 years. The HIT has an undergraduate degree in computer science and business administration and has worked in healthcare information technology for over 20 years. Our CEO, CFO and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have over 20 years of experience managing risks at VirBio and at similarly situated companies, including risks arising from cybersecurity threats. For example, our CFO has been responsible for leading and managing Information Technology departments at two separate publicly traded companies, including our Company, and has leadership experience in business continuity planning in various roles. Additionally, one of our directors formerly served as the United States Secretary of Homeland Security, in which capacity she had ultimate responsibility for the cybersecurity of the critical infrastructure of the United States of America, and as President of the University of California with responsibility for cybersecurity matters related to the university's various networks.


text: Risk and Issues Disclosure We describe the risks we face, including cybersecurity risks, in Section 1A above, titled "Risk Factors". For the period covered by this Annual Report on Form 10-K, we are unaware of any specific cybersecurity threats that have materially affected the Company, its business strategy, results of operations or financial condition.


text: We are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach, guided by Federal Information Processing Standards Publication 199, to identify, classify, and appropriately assess the range of cybersecurity threats that could affect our business and information systems. Accordingly, security incidents are evaluated, classified by severity and prioritized for response, mitigation and remediation. From a high level, our incident response framework consists of five elements: (1) proactively identifying and appropriately managing cybersecurity risks to our systems, assets, data, and other capabilities; (2) designing and implementing the appropriate safeguards to timely deliver business services; (3) implementing systems and processes to detect the occurrence of cybersecurity events; (4) responding to events in a systematic and comprehensive fashion; and (5) utilizing mechanisms to promote system resilience and the restoration of critical business functions that may have been impaired due to a security incident.

companyName: Core Scientific, Inc./tx

ticker: CORZ


text: Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Fundamentally, our information security program is tasked with developing pragmatic strategies for preserving the confidentiality, integrity and availability of Company and customer information. Pursuant to this approach, we have implemented controls to prevent, detect and mitigate cybersecurity risks posed by third parties. We use various tools and methodologies, including a written incident response plan and cybersecurity insurance, to manage and mitigate cybersecurity risk. Those tools and methodologies are evaluated on a regular and continuing basis. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Through both short-term "game day" events and more prolonged campaigns, red team programming is designed to continuously stress test the fortitude of our information security systems and assist in identifying areas of potential vulnerability. Based on the results of these simulated exercises, we aim to harden any identified exposure points and adjust our security processes to ensure dynamism and responsiveness. Along with our in-house cybersecurity capabilities, we also periodically engage third parties to assist with detecting and responding to cybersecurity risks. Third parties may be engaged to assist with procedures including red and blue team training exercises and penetration testing. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Amongst other controls, we maintain policies and practices that monitor, regulate and limit remote access of our information systems.


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are likely to, materially affect us, our business strategy, results of operation or financial condition. For more information on the risks from cybersecurity threats that we face, refer to Part I, Item 1A. "Risk Factors," of this Annual Report on Form 10-K, including but not limited to the risk factors titled, "We may be vulnerable to both physical and cybersecurity breaches, which could disrupt our operations and have a material adverse effect on our business, financial condition and results of operations" and "We may be exposed to cybersecurity threats and breaches, which could have a material adverse effect on our business, financial condition and results of operations."


text: Our information security team is led by our Chief Information Security Officer and is comprised of dedicated professionals responsible for overseeing cybersecurity risk management and mitigation, incident prevention, detection and remediation. These teams are spearheaded by professionals with decades of cybersecurity leadership experience across multiple industries, including our Chief Technology Officer. Our leadership working group meets on a weekly basis to discuss our approach to the rapidly-evolving cybersecurity landscape. To ensure that our top-level strategy is disseminated throughout the Company, our information security team provides hands-on and often role-specific training and awareness programs to our employees. Our employees with network access participate annually in required training, including spear phishing and other awareness training. We also periodically conduct simulated phishing exercises to practice appropriate response and augment employee awareness of established and emerging cyber threats.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including cybersecurity risk. Our Board of Directors considers cybersecurity risk and mitigation as a critical component of its risk oversight function and intends to further develop specific cybersecurity oversight functions and protocols. Our Board of Directors administers this oversight function directly through the Board of Directors as a whole, as well as through various standing committees of our Board of Directors, including the Audit Committee, that address risks inherent in their respective areas of oversight. In particular, our Board of Directors is responsible for monitoring and assessing strategic risk exposure and our Audit Committee has the responsibility to consider and discuss our major financial risk exposures and the steps our management has taken to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. The Audit Committee also monitors compliance with legal and regulatory requirements and is charged with oversight of the adequacy of Company's insurance programs, including cyber insurance.


text: Our various corporate information technology, accounting and financial reporting platforms, enterprise applications and related systems (our "Information Systems") are necessary for our business. We use these systems, among others, to manage key aspects of our business, including relationships with our tenants and vendors, accounting, acquisitions, internal and external communications and property and asset management. We also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data related to our business (our "Sensitive Data"). We utilize a third-party managed information technology service provider (the "MSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our cybersecurity risk management is integrated into our overall enterprise risk management and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management.

companyName: Postal Realty Trust, Inc.

ticker: PSTL


text: We and our MSP identify, assess and manage material cybersecurity threats and risks to our Information Systems and Sensitive Data through the following, among others: • a multidisciplinary team, including a dedicated technology committee (the "Technology Committee") comprising members from senior management, asset management and accounting and legal functions, in conjunction with our MSP and other third-party service vendors, to identify, assess and manage cybersecurity threats and risks; • various internal processes and procedures to monitor and evaluate threat environment and our risk profile using methods such as manual and automated tools, subscribing to reports and services that identify and analyze cybersecurity threats, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and conducting threat and vulnerability assessments; • various technical, physical and organizational processes and policies to manage and mitigate material cybersecurity risks, such as risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training and penetration testing; and • working with third-party vendors from time to time that assist us to identify, assess and manage cybersecurity risks, such as professional services firms and penetration testing firms.


text: For third-party service vendors that perform a variety of important functions for our business, we seek to engage reliable, reputable service vendors that maintain cybersecurity programs. Depending on the nature and risk profile of the services provided and the sensitivity of information processed, we may from time to time conduct a review of the cybersecurity practices of such vendor, contractually imposing obligations on the vendor and conducting periodic reassessments during their engagement. We are currently not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or, to our knowledge, are reasonably likely to materially affect our business, financial condition and results of operations. See to Item 1A. "Risk Factors" in this annual report on Form 10-K, including "We face cybersecurity risks and risks associated with security breaches", for additional discussion about cybersecurity-related risks.


text: Our Board of Directors oversees our strategy and risk management, including material cybersecurity risks. The Audit Committee of the Board of Directors (the "Audit Committee") oversees our cybersecurity and information technology risk exposures, as well as our cybersecurity and information technology policies and programs, in accordance with its charter. The Audit Committee holds quarterly meetings and receives periodic reports from, and also engages in regular discussions with, management and also our MSP regarding our significant cybersecurity risk exposures and the measures implemented to monitor and control these risks. Our Technology Committee also meets at least quarterly to assess cybersecurity risks and prepares reports to the Audit Committee. A number of members of our Technology Committee have gained relevant knowledge, skills and experience in information technology and cybersecurity risk management, including overseeing third-party vendors in such areas, over their careers at the Company or other organizations.


text: Management is responsible for hiring and overseeing third-party vendors related to cybersecurity and integrating cybersecurity risk considerations into our overall risk management strategy. Our internal cybersecurity incident response processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances and reporting to the Audit Committee for certain cybersecurity incidents, which also allows decisions regarding the public disclosure and reporting of such incidents to be made by management, the Audit Committee and the Board in a timely manner.


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical information technology and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, and customer and employee data ("Information Systems and Data").

companyName: Sweetgreen, Inc.

ticker: SG


text: Our Chief Technology Officer ("CTO"), as well as the security operations, engineering, risk management and legal functions help identify, assess and manage the Company's cybersecurity threats and risks. Our security operations team monitors and identifies potentially material cybersecurity threats and risks, and implements and maintains the Company's incident management policies and plans. Our security operations team leads our efforts to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, subscribing to reports and services that identify cybersecurity threats, monitoring incident notifications from stakeholders, conducting threat assessments, managing software vulnerabilities and patches, conducting tabletop incident response exercises, and, in connection with our legal function, coordinating with law enforcement concerning threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; vulnerability management activities; encryption of data; network security controls; data access controls; penetration testing; cybersecurity insurance; and a dedicated security operations team.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and provides an annual cybersecurity update to each of the board of directors and the audit committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, forensic investigators, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as account management, payment processing, cloud-based infrastructure, data center hosting, and content delivery to customers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If the confidentiality, integrity, or availability of our information technology, software, services, communications, or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including supervision, mitigation, and disclosure of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CTO and members of our legal and cybersecurity teams. Our CTO has more than three decades of experience working in technology for global companies in the technology, retail, and food services industries and has served in senior management at another public food service company.


text: Senior management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Senior management is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity policies and processes, and reviewing security assessments and other security-related reports.


text: Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Executive Officer, Chief Legal Officer, and Chief Financial Officer. The Chief Legal Officer works with the Company's cybersecurity incident response team to help the Company mitigate and remediate cybersecurity incidents of which he is notified. In addition, the Company's incident response process includes reporting material incidents to the audit committee of the board of directors.


text: The audit committee and the full board receive annual reports from senior management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to certain cybersecurity threats, risks, and mitigations.


text: The Company depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, administrative agents, fund administrators and other third parties to source, make and manage its investments. Accordingly, the Company's business is dependent on the communications and information technology ("IT") systems that it shares with the Advisers and their ultimate parent company, TIAA, which further relies upon the systems of third-party IT service providers to TIAA. TIAA has established a cybersecurity program across its enterprise, which applies to certain of its affiliates, including the Advisers and the Company. When identifying and overseeing risks from cybersecurity threats associated with its use of third-party service providers, the Company further relies upon the expertise of risk management, legal, information technology, and compliance personnel of TIAA. TIAA conducts onboarding and ongoing due diligence of certain of the Company's key third-party service providers to identify and oversee risks from cybersecurity threats associated with the Company's use of such entities.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Company and the Advisers. Cyber risk management is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Company and other affiliates of TIAA.


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company and the Advisers, in connection with their day-to-day operations. TIAA's cybersecurity leadership team are responsible for maintaining and overseeing the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting TIAA and its affiliates, including the Company, the Advisers and their respective third-party service providers.


text: TIAA's management team, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Company and the Advisers. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering, and have cybersecurity leadership experience in other major financial institutions.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.


text: Oversight of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company is assessed on an ongoing basis, as well as how such risks could materially affect the Company's business strategy, operational results, and financial condition. Cybersecurity risk remains heightened to the financial industry, including the Company, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact the Company's operations. TIAA and the Advisers continue to invest in the cybersecurity program to protect against emerging threats, including threats against third parties and service providers. The Company has not experienced any material cybersecurity incident, and the Company is not aware of any cybersecurity risks that are reasonably likely to materially affect its business.


text: TIAA's cybersecurity team periodically reports to the Company's management on cybersecurity matters, primarily through presentations. Such reporting will include updates on TIAA's cybersecurity program as it relates to the Company, the external cybersecurity threat environment, and TIAA's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on TIAA's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.


text: The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Board receives periodic updates from the Company's management regarding TIAA's cybersecurity program, information on current threat landscape and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: The Company faces cybersecurity threats such as ransomware and denial-of-service. The Company's customers, vendors and business partners face similar cybersecurity threats, and a cybersecurity incident impacting the Company or any of these third-party entities could materially adversely affect our operations, performance and results of operations. In particular, the Company emphasizes the importance of cybersecurity as it may receive, store and transmit personal medical and other information relating to its customers, and believes it is imperative to protect this information from potential threats.

companyName: Verano Holdings Corp.

ticker: VRNO


text: Additionally, the Board recognizes the critical importance of maintaining the trust and confidence of the Company's customers, vendors, business partners and employees. The Board oversees the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's Cybersecurity Incident Response Plan (the "Cybersecurity Plan"), which includes the Company's standards, processes and practices are a component of the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company's Cybersecurity Plan states that it seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on (i) preserving restrictions on information access and disclosing, including means for protecting the confidentiality of personal private and proprietary information, (ii) guarding against improper information modification or destruction, and (iii) ensuring timely and reliable access to the Company's information systems.


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: The Company's Cybersecurity Plan lays out on-going processes for incident response and prevention, including processes for bettering Company cybersecurity response following any cybersecurity incidents. All employees undergo training to aid in understanding the Company's expectations for safeguarding all data stored on Company cyber networks. In addition to its Cybersecurity Plan, the Company has established risk management guidelines (the "Risk Management Guidelines") that address the Company's response to risks, including a cybersecurity incident. The Risk Management Guidelines describe the Company's policy of managing enterprise risk, including external risks arising from cybersecurity threats and provide that the audit committee of the Board (the "Audit Committee") will coordinate with and assist the Board in its oversight of risk.


text: The Company's Risk Management Guidelines also dictate that the Board will conduct an annual performance evaluation of the Board's oversight of the Company's overall risk-taking tolerance and management, conducted in such manner as the Board deems appropriate.


text: Identify Risks and Notify Company of Risks: The Cybersecurity Plan dictates an approach to identify and confirm expected incidents, to determine the severity of the risk and promptly take basic initial containment steps. The Cybersecurity Plan includes notification processes for certain cybersecurity incidents which aim to inform and activate an incident response team consisting of officers and employees at the Company and certain external service providers.


text: Containment, Eradication and Recovery: The Company's Cybersecurity Plan includes processes for containing ongoing cybersecurity threats if they occur and preventing past malicious activity, providing proposed solutions to malicious activity, and recovering any business processes with the goal of restoring business operations.


text: The Company's Cybersecurity Plan contemplates a Company response to cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Use of Third-Party Vendors: Per the Company's Risk Management Guidelines, the Board may, in its discretion, delegate all or a portion of its duties and responsibilities to other committees of the Board. While the Board has not yet engaged assessors, consultants auditors or other third parties to aid in processes related to cybersecurity threats, any such committee will have the resources and authority appropriate to discharge its duties and responsibilities, including the authority to select, retain, terminate, and approve the fees and other retention terms of special or independent counsel, accountants or other experts, as it deems appropriate, without seeking approval of the Board or management. The Company may, from time to time, engage third party vendors to assist in developing, identifying and managing risks.


text: The Board has reviewed and discussed with management, the Company's risk assessment process, risk management framework and reporting mechanisms, implementation and monitoring, including as each of these relates to cybersecurity risks. The Audit Committee coordinates and assists the Board in its oversight of risk. The Board and Audit Committee each receive presentations and reports on Company risks, including cybersecurity risks. The Cybersecurity Plan also contemplates that the Board will also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board has discussed the Company's approach to cybersecurity risk management with the members of management, including the Company's Executive Vice President of Information Technology.


text: The Company has a Cyber Incident Response Team (the "IRT"), which is comprised of employees including, among others, the Executive Vice President of Information Technology, the Chief Financial Officer ("CFO"), the Chief Operations Officer ("COO") and the Chief Legal Officer ("CLO"), as well as potential outside advisors and service providers, as deemed appropriate. The Cybersecurity Plan contemplates that, in the case of a cybersecurity risk, Executive Vice President of Information Technology, in coordination with the IRT, will work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, the Cybersecurity Plan contemplates that multidisciplinary teams throughout the Company will be deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Cybersecurity Plan dictates that the Executive Vice President of Information Technology and the IRT monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The Executive Vice President of Information Technology has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Officer of other public companies.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we do not believe are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cybersecurity attack disrupts the Company's critical operations, service or financial systems. See "Item 1A — Risk Factors — Risks Related to our Business and Operations — Information Technology, Cybersecurity and Intellectual Property" for additional information on risks related to cybersecurity threats.


text: We have an enterprise-wide approach to addressing cybersecurity risk, including input and participation from management and support from our Information Technology ("IT") Steering Committee that is comprised of our Senior Vice President Electronic and Structural Systems, Chief Financial Officer, General Counsel, Chief Human Resources Officer, Vice President Supply Chain Management, and Chief Information Security Officer (Head of IT and Cybersecurity or "CISO"). Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Framework which is augmented with Cybersecurity Maturity Model Certification ("CMMC") components to meet our particular needs. We regularly assess the threat landscape and take a holistic view of the cybersecurity risks, with a layered cybersecurity strategy based on protection, detection, and mitigation. Our IT security team, which is comprised of internal resources, reviews enterprise risk management-level cybersecurity risks at least annually.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: Our CISO is responsible for developing, implementing, and maintaining our information security strategy and program, as well as reporting various cybersecurity risk matters to our IT Steering Committee, and the Board's Innovation Committee. The Innovations Committee is a subset of the full Board of Directors which receive regular updates on our cybersecurity program.


text: Our CISO has over 18 years of experience leading cybersecurity oversight for several companies and is updated on cyber events related to the monitoring, prevention, detection, mitigation, and remediation efforts from our IT security team. The IT security team have broad cybersecurity expertise or industry certifications and are knowledgeable in the use of cybersecurity tools and software. In addition, third-party cybersecurity services are used to augment our in-house capabilities, as needed.


text: We continue to expand investments in IT security, including additional end-user security awareness training, using layered defenses, identifying and protecting critical systems, strengthening monitoring and alerting, and engaging experts as needed. We also use an industry standard risk quantification model to identify, measure, and prioritize cybersecurity risks. This in turn, helps us develop and implement effective security controls and technology defenses. In addition, all employees are required to complete various cybersecurity awareness trainings on a regular basis. Further, we perform periodic simulations and tabletop exercises with the IT security team and will continue to expand its participants as appropriate. Our assessment of risks associated with the use of third party providers is on a limited basis and is part of our current overall cybersecurity risk management approach. As the threats and attacks are becoming more sophisticated, we will modify and enhance our cybersecurity program as needed.


text: As a defense contractor, we must also comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement ("DFARS") related to adequately safeguarding controlled unclassified information ("CUI"). The Department of Defense ("DoD") will require defense contractors to comply with its CMMC program in the near future. We are incorporating the requirements of the CMMC program into our overall cybersecurity program and anticipate we will be in position to meet such requirements by the time it becomes fully rolled out in 2028.


text: To date, we do not believe risks from c ybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected us or are reasonably likely to materiality affect us, including our business strategy, results of operations or financial condition. See "Cybersecurity attacks, internal system or service failures may adversely impact our business and operations" in Risk Factors included in Part I, Item 1A of this Form 10-K. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with third-parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventive measures. For more information regarding the risks we face from cybersecurity threats, please see "Cybersecurity attacks, internal system or service failures may adversely impact our business and operations" in Risk Factors included in Part I, Item 1A of this Form 10-K.


text: We are a clinical-stage biotechnology company and continue to mature as a public company since our initial public offering in 2020. We have developed cybersecurity policies, procedures and practices and an enterprise risk management program designed to align to the nature, size and scale of our business operations and cybersecurity threat profile.

companyName: COMPASS Pathways plc

ticker: CMPS


text: Our board of directors has delegated oversight responsibility for risk management, including cybersecurity risks, to our audit and risk committee, and such responsibilities are set forth in the audit and risk committee's charter. At routine board meetings, the chair of the audit and risk committee regularly provides a report to the full board on the committee's oversight activities.


text: As part of our enterprise risk management program, which is overseen by the audit and risk committee, we identify and review risks related to cybersecurity on a regular basis, including risks related to third-party access to our information technology systems. We conduct periodic enterprise risk assessments and report the results to the executive team and the audit and risk committee.


text: Our chief technology officer, with 14 years of experience in information technology, artificial intelligence and software engineering, is responsible for managing and assessing risks related to cybersecurity and data governance. Our chief technology officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, through our security incident response process. Our chief technology officer supervises our vice-president of information technology, who has primary operational responsibility for managing the overall cybersecurity posture and strategy, managing internal and external cybersecurity resources and organizing and leading efforts to prevent, detect and respond to cybersecurity incidents and threats. Prior to joining the company, our chief technology officer previously served in various data and technology leadership roles, including most recently as chief data officer at another biotechnology company. Our vice-president of information technology has 25 years of experience in information technology and most recently served as senior director of information technology operations and infrastructure at another biotechnology company. As part of our quarterly disclosure committee process, our chief technology officer discusses with our chief executive officer, chief financial officer and other members of the disclosure committee, any significant cybersecurity issues, including any potential risks related to cybersecurity incidents.


text: Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into our overall enterprise risk management system. We have developed and implemented policies, procedures and practices designed to protect the information and systems that support our operations and assets. In developing our policies and procedures, we were informed by certain industry standards and guidelines. We routinely train our employees on cybersecurity awareness and our information security and data protection policies.


text: We have policies and procedures designed to prevent, detect and respond to cybersecurity incidents or threats. We use industry standard security and monitoring systems that are managed by our internal information technology team with support from third-party IT services firms. We also periodically conduct security testing or hire third-parties to conduct security testing, such as phishing testing and penetration testing. The results of our security testing are reported to our chief technology officer and, when relevant, with the wider executive team.


text: When engaging third-parties, we have procedures and protocols designed to protect our information technology systems and our confidential information. For example, before we grant third-parties access to our information technology systems, we require typically agreements with such third-parties, we ordinarily require such third parties to complete cybersecurity training and we typically require specific contract terms in our agreements with such third-parties.


text: To date, we have not identified any risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents experienced by us or, to our knowledge, by any of our third-party service providers, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Our business and operations would suffer in the event of computer system failures, cyber-attacks or deficiencies in our cyber security or cyber security of our collaborators, vendors and other partners." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks.


text: We rely on information technology ("IT") systems, including data hosting facilities and other hardware and software platforms, some of which are hosted by third parties, to assist in conducting our businesses. Our IT systems, like those of most companies, may be vulnerable to certain cybersecurity threats such as ransomware, interruption of services, data breaches, or any other cybersecurity incident that could adversely impact our ability to operate our core business functions. As a real estate finance services firm, we do not maintain a significant level of personally identifiable information data, so our exposure to data breaches is limited. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. However, we have, from time to time, experienced threats to our data and systems, including from malicious software and computer virus attacks. We anticipate we will continue to face similar threats, including attempts for unauthorized access, in the future. We also maintain a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents, though coverage may not be available or sufficient to cover costs of certain cybersecurity incidents.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: We consider cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. We have implemented a robust cybersecurity program that employs various controls and activities aimed at identifying, protecting against, detecting, and responding to cybersecurity threats. These controls, including endpoint and network monitoring, endpoint protection, and network security measures, safeguard our assets from unauthorized access and attacks. We prioritize data protection through data classification and access management designed to permit access only by authorized personnel. Our cybersecurity incident response plan, integrated into the enterprise risk management framework, outlines a structured process for handling cybersecurity incidents involving assets or data. It guides our cybersecurity incident response team in containing, eradicating, and recovering from incidents while minimizing damage and disruption. The plan includes a clearly defined notification framework for timely communication to relevant parties, that may include our management team, Board of Directors and Audit Committee, based on the incident's severity and potential impact. Controls and related activities are designed taking into consideration recognized third party cybersecurity frameworks.


text: We utilize on-premises and cloud-based security solutions, with real-time monitoring provided by specialized managed security services providers. These external managed security service providers collect events generated by critical systems in real-time, filter non-security events, and then correlate the information using security data analytical engines so that personnel can identify and analyze threats.


text: Annual risk assessments of our Information Security Program are conducted to identify emerging information security and third party risks. In addition, periodic vulnerability assessments and penetration tests are conducted to support the identification of risks. We also conduct independent audits, including through the use of third-party assessors on both the design and operational effectiveness of security controls and consult with external advisors on best practices to address new challenges.


text: An external vendor risk management platform is utilized to evaluate, rate, monitor, and track vendor risk pertaining to our critical vendors. The security practices and processes of the service providers are monitored regularly, and periodic assessments may be performed on the service providers'compliance with cybersecurity terms, based on the service providers' risk. For any of our hosted applications we by default require the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third party providers is part of our overall cybersecurity risk management framework.


text: We also periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete a monthly computer-based Security Awareness Training Program that includes various topics on cybersecurity risk management best practices. This program educates users to identify information security threats and what actions should be taken. Additionally, employees are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Oversight of cybersecurity is a joint responsibility of our Board of Directors and Audit Committee, with each receiving at least quarterly updates on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents. The Board and Audit Committee also may receive updates on topics such as the results of various cybersecurity assessments, third party risk management, and evolving risks.


text: Our Chief Information Officer leads our overall cybersecurity function and is responsible for developing and implementing our information security program and managing our response to threats. In addition to our in-house cybersecurity capabilities, at times we also engage third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of our IT security team, including the third party security firms we utilize as part of our program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.


text: Trulieve recognizes the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of the data we produce and collect.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: Managing Material Risks & Overall Risk Management We have a cross-departmental approach to addressing cybersecurity risk, including input from our employees, senior management, and the Audit Committee of our Board of Directors (the "Board"). We devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats promptly and effectively.


text: We have a set of Company-wide cybersecurity policies and procedures and continue building these important document libraries. Management approves initial policies and reviews them periodically for updates and changes. Our cybersecurity program follows the internationally recognized risk framework, ISO 27001. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a multi-faceted cybersecurity strategy based on prevention, detection, and mitigation. The Company continues to work to ensure that our cybersecurity risks fully integrate into the Company's overall risk management approach.


text: Management and oversight As part of our cybersecurity program, we engage with external service providers in our continuing cybersecurity efforts. These providers assist us in evaluating and enhancing the effectiveness of our information security policies and procedures. The partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity policies and procedures are comprehensive, up-to-date, and aligned with regulatory requirements.


text: The use of these third-party providers is regularly reviewed and monitored by the appropriate members of management. We conduct thorough assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges with a material impact on our strategic plan, operations, or financial standing. For additional information, see "Item 1A. Risk Factors - We are subject to security risks related to our products as well as our information and technology systems".


text: Trulieve's cybersecurity program is managed under the management purview of our Chief Technology Officer (" CTO ") and our Senior Director of Information Security, whose team (the "Cybersecurity Team") is responsible for facilitating the enterprise-wide cybersecurity program. Our CTO has over 20 years of experience with large information technology footprints, including cybersecurity. His in-depth knowledge and expertise are instrumental in supporting our cybersecurity program and policies and overseeing our governance and compliance programs. The Information Security Governance Committee ("the IT Committee") and the Audit Committee of our Board of Directors oversee management's process for identifying and mitigating risks, including cybersecurity risks. The Audit Committee comprises board members with diverse expertise equipping them to oversee cybersecurity risks effectively.


text: Management's role in assessing and managing material risks from cybersecurity threats involves leadership, governance, resource allocation, and proactive risk management. Management's involvement is crucial in safeguarding the Company's digital assets, reputation, and long-term success. Our Cybersecurity Team provides periodic reports to our IT Committee and Audit Committee, our Chief Executive Officer, and other members of senior management as appropriate.


text: The IT and Audit committees actively participate in discussions with management regarding cybersecurity risks. The IT Committee and Audit Committee assess the Company's cybersecurity program at least annually, including discussing management's actions to identify and detect threats, and scenarios for potential response or recovery situations. In addition to regularly scheduled meetings, the IT and Audit Committee and appropriate senior management levels maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.


text: Papa Johns' cybersecurity program includes a defense-in-depth model that utilizes a variety of techniques and tools for protecting against, detecting, responding to and recovering from cybersecurity incidents. Our cybersecurity program is designed to prioritize detection, analysis and response to known and anticipated cyber threats, effective management of cyber risks, and resilience against cybersecurity incidents. Our program leverages industry frameworks, including the Payment Card Industry (PCI) Standards and the Center for Internet Security (CIS) security framework.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: At Papa Johns, the Company's cybersecurity strategy and risk management is overseen by the Board of the Directors (the "Board") through its Audit Committee and implemented and managed by the Company's Cyber Oversight Group, a cross-functional team of senior management.


text: Board Governance The Audit Committee and the Board consider cybersecurity part of the Company's overall enterprise risk management ("ERM") function, which the Audit Committee oversees. The Audit Committee and the Board consider cybersecurity as part of the Company's business strategy, financial planning, and capital allocation.


text: The Audit Committee provides oversight of our cybersecurity program, which includes annual and periodic reviews of our cybersecurity program and cybersecurity risks. As part of its oversight responsibility, and pursuant to its charter, the Audit Committee reviews with management and reports to the full Board with respect to significant cybersecurity matters and risks and management's actions to monitor and address identified issues. The Internal Audit team also meets periodically with the VP, Information Security and Compliance officer along with key IT leadership to discuss open cyber or data security risks. This effort is to help ensure items of risk are addressed and resolved in a timely manner. The Audit Committee receives updates from the Company's recently appointed Chief Digital and Technology Officer ("CDTO"), VP, Information Security and Compliance, and/or members of our executive leadership team. Management also reports to the full Board at least annually regarding a comprehensive overview and status of the Company's information security program. The Audit Committee is also apprised of cybersecurity incidents consistent with the provisions of our recently enhanced cybersecurity incident response plan ("IRP") pertaining to escalation of more significant cybersecurity incidents.


text: Management Governance The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Cyber Oversight Group, led by our CDTO and VP, Information Security and Compliance. Our CDTO has decades of experience as Chief Technology Officer with multiple companies, and significant expertise in enterprise architecture, engineering, analytics and digital technology. In addition, our VP, Information Security and Compliance has over 20 years of experience as a Chief Information Security Officer in multiple industries and has received Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC) certifications. Our CDTO and VP, Information Security and Compliance are responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats.


text: Members of our Cyber Oversight Group also include our Chief Executive Officer, Chief Financial Officer, Chief Legal and Risk Officer, Senior Director of Internal Audit, VP of International Technology, and technology and data privacy in-house counsel. The Cyber Oversight Group is also tasked with reporting to the Audit Committee on cybersecurity risk management strategies, as well as any significant cybersecurity incidents that may occur. In addition, the Cyber Oversight Group meets at least four times per year, or with greater frequency as necessary, to, without limitation: • review with management the Company's cybersecurity threat landscape, risks, and data security programs, and the Company's management and mitigation of cybersecurity risks and incidents; • review with management the Company's compliance with applicable information security and data protection laws and industry standards; • discuss with management the Company's cybersecurity, technology and information systems policies as to risk assessment and risk management, including the guidelines and policies established by the Company to assess, monitor, and mitigate the Company's significant cybersecurity, technology and information systems related risk exposures; and • review and provide oversight on the Company's crisis preparedness with respect to cybersecurity, technology and information systems, including cybersecurity incident response preparedness, communication plans, and disaster recovery capabilities.