text: Program Assessments Our cybersecurity processes are evaluated as part of an ongoing assessment of our internal control environment, which are informed by the five pillars of the NIST Cybersecurity Framework ("NIST CSF"). We employ a third-party service provider to conduct periodic penetration tests and scan different parts of our IT environment for potential vulnerabilities. We prioritize critical or high vulnerabilities for swift remediation. Additionally, we employ a third-party service provider for continuous cybersecurity risk and vulnerability monitoring. We make continuous adjustments to system and network configurations to mitigate or remediate identified vulnerabilities.


text: Cybersecurity incident response procedures are informed by NIST Special Publication 800-61, and continuously improved following quarterly exercises and live incidents. Incident response emphasizes rapid containment following detection of a range of threats including: • repeated login failures; • suspicious network traffic; • malware detection; and, • other threats as prioritized through a combination of industry threat intelligence via the Healthcare Information Sharing and Analysis Center and the Company's security operation center.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX

secItem: Item 1C


text: We focus on further building cybersecurity resiliency throughout our value chain. We perform risk management via an industry third-party risk management service provider for all critical vendors, partners, and systems (including third-party hosted information systems) meeting our risk management policy criteria, to minimize the likelihood and impact of malicious cybersecurity incidents. During the onboarding phase, our cybersecurity team under the direction of the Sr. Director Information Security, Compliance, and Privacy, performs a technological risk assessment on, and utilizes certain tools to detect external risk posed by, the vendor, partner and/or system. Vendors identified as posing elevated risk are escalated to senior management for informed risk tolerance determination. Following the onboarding phase, the cybersecurity team continuously monitors risks related to the vendor, partner and/or system. All third-party cybersecurity incidents are tracked though the third-party service provider and are communicated to our cybersecurity team upon discovery. We prioritize our mitigation of cybersecurity risks based on relative severity (e.g., critical risk, high risk, low risk) and document a mitigation plan that details a resolution timeline.


text: Identified cybersecurity risks, including third-party risks and internal risks, are documented and managed in a risk register, which is reviewed monthly with leaders of our internal audit, compliance, and IT departments to ensure visibility and consensus in a separation-of-duties structure. Risks are stratified according to a standard calculus of probability, severity and materiality.


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, a significant cybersecurity incident may materially impact our business strategy, results of operations and financial condition. Such significant cybersecurity incidents include, but are not limited to: • ransomware infiltrating our critical systems resulting in production delays and/or loss of critical information; • cyber theft of our IP; • cyber theft of customer and/or patient information; • cyberattack on a critical partner that disrupts our supply chain and/or services; and, • cyberattacks that significantly impact our brand perception.


text: As discussed more fully under Part 1, Item 1A, Risk Factors, "We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks," the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner Board Oversight and Management's Responsibilities Board Oversight


text: While our Board of Directors is ultimately responsible for risk oversight, committees of the Board of Directors assist in fulfilling oversight responsibilities in certain areas of risk. The Audit Committee of the Board of Directors (the "Audit Committee") is responsible for overseeing risks from cybersecurity threats. The Audit Committee receives cybersecurity updates from IT leadership at least twice a year. When meeting with the Audit Committee, the IT leadership team highlights significant accomplishments and issues related to our IT infrastructure, including cybersecurity incidents, risks, industry trends, notable incidents facing other companies, incident preparedness and other developments. The Audit Committee also receives updates regarding progress on initiatives to further align with the five pillars of the NIST CSF. These briefings are designed to provide visibility to the Audit Committee about the identification, assessment, and management of critical risks, audit findings, and management's risk mitigation strategies.


text: Management Oversight Our IT department, in conjunction with the compliance department, assess and manage risks related to cybersecurity. The Sr. Director of Global Information Security, Compliance, Privacy, is the primary management personnel responsible for our cybersecurity program. He has more than twenty years of experience as an information security specialist and holds various cybersecurity professional certifications, including as a Certified Information Security Manager by the Information Systems Audit and Control Association and a Certified Information Systems Security Professional by the International Information System Security Certification Consortium. In addition, the department heads for IT and internal audit have industry recognized credentials and extensive experience in the area of cybersecurity. Specific cybersecurity incidents are tracked by a third-party service provider through a ticketing system.


text: Should cybersecurity issues arise throughout the quarter, management would determine whether a cybersecurity incident was material and decide on appropriate reporting and mitigation measures. Following this determination, management would promptly schedule a meeting with the Audit Committee.


text: Risk Management & Strategy Our cybersecurity program includes policies and procedures designed to protect our systems and operations as well as sensitive information and data from anticipated cybersecurity threats. This program is a key component of our approach to enterprise risk management.


text: Our cybersecurity defenses include multiple layers of processes and technologies that can help prevent, detect and respond to cybersecurity threats. We administer multiple cybersecurity-related training and awareness events annually. These include baseline cybersecurity training for all new employees and an annual, mandatory, interactive cybersecurity training for all who are assigned our user accounts, and frequent cybersecurity topic awareness broadcast emails and targeted training to specific user groups. Additionally, we use a variety of detective and preventive technologies, including: • email threat detection; • endpoint detection and response; • a 24 hours a day, 7 days a week security operations center that monitors system log telemetry and threat intelligence via a security incident and event management platform; • vulnerability scanning on both internal and externally-facing infrastructure; • next-generation firewalls with geographic access restriction for sensitive externally-facing systems; • multi-factor authentication for remote access and certain internal systems; • data loss prevention for email traffic containing sensitive information; • domain name service threat detection; and • internal incident response procedures based on NIST Special Publication 800-61.


text: We also conduct periodic phishing attack simulations to evaluate users' vulnerability to emerging email threats. We conduct remediation training where failures occur. On a quarterly basis, our cybersecurity team also conducts scenario-based tabletop exercises with critical business teams to simulate disasters and cyberattacks. The tabletop exercises test and fine-tune our business continuity plans and incident response procedures.


text: Cybersecurity incident response procedures are informed by NIST Special Publication 800-61, and continuously improved following periodic exercises and live incidents. Incident response emphasizes rapid containment following detection of a range of threats including: • suspicious repeated login failures; • suspicious network traffic; • malware detection; and • other threats as prioritized through a combination of industry threat intelligence via the Healthcare Information Sharing and Analysis Center and the Company's security operation center.


text: We focus on further building cybersecurity resiliency throughout our value chain. We perform risk management via an industry third-party risk management service provider for all critical vendors, partners, and systems (including third-party hosted information systems) meeting our risk management policy criteria, to minimize the likelihood and impact of malicious cybersecurity incidents. During the onboarding phase, our cybersecurity team under the direction of the Sr. Director Information Security, Compliance, and Privacy, performs a technological risk assessment on, and utilizes certain tools to detect external risk posed by, the vendor, partner and/or system. Vendors identified as posing elevated risk are escalated to senior management for informed risk tolerance determination. Following the onboarding phase, the cybersecurity team continuously monitors risks related to the vendor, partner and/or system. All third-party cybersecurity incidents are tracked though the third-party service provider and are communicated to our cybersecurity team upon discovery. We prioritize our mitigation of cybersecurity risks based on relative likelihood and severity (e.g., critical risk, high risk, low risk) and document a mitigation plan that details a resolution timeline.


text: Identified cybersecurity risks, including third-party risks and internal risks, are documented and managed in a risk register, which is reviewed regularly with leaders of our internal audit, compliance, and IT departments to ensure visibility and consensus in a separation-of-duties structure. Risks are stratified according to a standard calculus of probability, severity and materiality.


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, a significant cybersecurity incident may materially impact our business strategy, results of operations and financial condition. Such significant cybersecurity incidents include, but are not limited to: • ransomware infiltrating our critical systems resulting in production delays and/or loss of critical information; • cyber theft of our IP; • cyber theft of employee and family member, customer and/or patient information; • cyberattack on a critical partner that disrupts our supply chain and/or services; and, • cyberattacks that significantly impact our brand perception.


text: As discussed more fully under Part 1, Item 1A, Risk Factors, "We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks," the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Management Oversight Our IT department, in conjunction with the compliance department, assess and manage risks related to cybersecurity. The Senior Director of Global Information Security, Compliance and Privacy, is the primary management personnel responsible for our cybersecurity program. He has more than twenty years of experience as an information security specialist and holds various cybersecurity professional certifications, including as a Certified Information Security Manager by the Information Systems Audit and Control Association and a Certified Information Systems Security Professional by the International Information System Security Certification Consortium. In addition, the department heads for IT and internal audit have industry recognized credentials and extensive experience in the area of cybersecurity. Specific cybersecurity incidents are tracked by a third-party service provider through a ticketing system.


text: Our operations utilize multiple information systems, including accounting software, human resources management software, back of house systems, supply chain software, our brands' mobile apps, online ordering platforms, in-restaurant kiosks, point-of-sale software, and back-of-house software. In the ordinary course of our business, we collect, process, transmit, disclose, and retain personal information regarding our employees, our franchisees, vendors, contractors, and guests (which can include social security numbers, social insurance numbers, banking and tax identification information, health care information for employees, and credit card information) and our franchisees collect similar information.

companyName: BurgerFi International, Inc.


text: To protect the information that we gather and the availability of our information systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems and contracting with outside cybersecurity firms to provide continuous monitoring of our systems as well as threat-detection services. We define a cybersecurity threat as any potential unauthorized occurrence on or conducted through our information systems or information systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: A security team led by a Chief Technology Officer ("CTO") principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches; Cybersecurity awareness training of our employees, incident response personnel, and senior management; A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents;


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding cybersecurity incidents, that we experience. The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: Our management team, including historically our CTO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our former CTO who recently left the company had significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance, including over 10 years of experience managing enterprise level programs over IT. The Company has identified a candidate that it desires to fill the role.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. Risk Factors for potential risks related to our information technology systems that we are subject to and that may materially adversely affect our business ("Security breaches of either confidential guest information in connection with, among other things, our electronic processing of credit and debit card transactions or mobile ordering app, or confidential employee information may adversely affect our business" and "Failure to comply with privacy and cybersecurity laws and regulations could cause us to face litigation and penalties that could adversely affect our business, financial conditions, and results of operations.").


text: The Company's information security program is managed through an effective enterprise-wide cybersecurity strategy, policies, standards, architecture, and processes. The Company is committed to compliance with the International Organization for Standardization's recognized cyber incident and cyber risk management frameworks. We are dedicated to cybersecurity and maintaining the trust and confidence of our customers and stockholders.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: The Company recognizes the increasing threats posed by cyber incidents and is dedicated to implementing robust cybersecurity practices. We have a comprehensive cybersecurity program designed to protect sensitive information, ensure the integrity of financial transactions, and maintain the confidentiality of our customers' data.


text: We have established procedures for timely reporting of significant cybersecurity incidents; our commitment involves promptly notifying regulatory authorities, customers, and other stakeholders in the event of any material cyber incidents that may impact our operations or the security of sensitive information. In particular, we have enhanced disclosure controls and procedures to meet the requirement to report material cybersecurity incidents on Form 8-K within four business days after we determine that an incident is material.


text: Additionally, we maintain a proactive cyber risk management framework to identify, assess, and mitigate potential risks. Our cybersecurity policies and practices are regularly reviewed and updated to address emerging threats. We work closely with industry experts and third-party vendors and leverage advanced technologies to enhance our effort to continually provide adequate cyber defenses.


text: The Company uses a multiple lines of defense management approach to managing cybersecurity. The Company's cybersecurity operations function is headed by the Vice President Information Security Officer ("ISO") who is responsible for managing information security risks by developing and implementing information security strategies, architecture, and procedures and acts as the first line of defense. The ISO leads a team of security professionals in safeguarding the Company's critical data, systems, and assets against threats, breaches, and attacks. The ISO is responsible for ensuring the confidentiality, integrity, and availability of information assets.


text: The information security program, policies, and standards are managed by the Vice President of Enterprise Technology Risk Management ("ETRM"), who leads the Company's enterprise-wide technology risk management function. The ETRM function acts as the second line of defense and provides independent risk oversight for the Company's technology operating infrastructure and Operations. The ETRM function manages testing of technology controls, technology risk assessments, risk reporting, information security third-party due diligence, monitoring the implementation of risk mitigation actions, and tracking their effectiveness over time. The Company's internal audit department acts as the third line of defense, providing the independent assurance function.


text: Concerning governance, oversight, and compliance, the Board of Directors plays an active role in overseeing our cybersecurity program. Regular briefings on cyber risk management and incident response activities are conducted, ensuring a high level of governance and accountability in addressing cybersecurity concerns. The Bank provides periodic reports to our Technology Committee and our Board of Directors, as well as to our senior management team as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: We are firm in our commitment to collaborate with regulatory authorities to enhance industry-wide cybersecurity standards. Given the continuously evolving cyber threat landscape, we are committed to continuous improvement in our cybersecurity practices. Regular assessments, testing, audits, and training are conducted to adapt to emerging threats and enhance our ability to safeguard the interests of our customers.


text: The Company remains dedicated in its commitment to cybersecurity and compliance cyber risk management and will continue to invest in and prioritize cybersecurity to protect all critical information.


text: The Company recognizes the increasing threats posed by cyber incidents and is dedicated to implementing robust cybersecurity practices. We have a comprehensive cybersecurity program designed to protect sensitive information, ensure the integrity of financial records and transactions, and maintain the confidentiality of our customers' data.


text: The Company uses a multiple lines of defense management approach to managing cybersecurity. The Company's cybersecurity function is headed by the Senior Vice President Chief Information Security Officer ("CISO") who is responsible for managing information security risks by developing and implementing information security programs, policies, strategies, architecture, standards, and procedures and acts as the first line of defense. The CISO leads a team of security professionals in safeguarding the Company's critical data, systems, and assets against threats, breaches, and attacks. The CISO is responsible for ensuring the confidentiality, integrity, and availability of information assets.


text: The Company's enterprise-wide technology risk management (ETRM) function acts as the second line of defense and provides independent risk oversight for the Company's technology operating infrastructure and operations. The ETRM function manages testing of technology controls, technology risk assessments, risk reporting, information security third-party due diligence, monitoring the implementation of risk mitigation actions, and tracking their effectiveness over time. The Company's internal audit department acts as the third line of defense, providing the independent assurance function.


text: Concerning governance, oversight, and compliance, the Board of Directors plays an active role in overseeing our cybersecurity program. Regular briefings on cyber risk management and incident response activities are conducted, ensuring a high level of governance and accountability in addressing cybersecurity concerns. Management provides periodic reports to our Technology Committee and our Board of Directors, as well as to our senior management team as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: We are firm in our commitment to collaborate with regulatory authorities to enhance industry-wide cybersecurity standards. Given the continuously evolving cyber threat landscape, we are committed to continuous improvement in our cybersecurity practices. Regular assessments, testing, audits, and training are conducted to adapt to emerging threats and enhance our ability to safeguard the interests of our customers and stakeholders.


text: We have implemented and maintain a cybersecurity program that includes various processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including clinical trial and candidate data, intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: Our information security function, led by our Vice President of Information Technology ("VP of IT"), helps to identify, assess and manage the Company's cybersecurity threats and risks. This function helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example deploying automated tools in certain environments, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain aspects of the Company's threat environment, evaluating certain threats that are reported to us, conducting internal and external audits and internal threat assessment of certain environments, engaging third parties to conduct threat assessments, and conducting vulnerability assessments.


text: We have engaged third-party providers to periodically assess certain of our internal controls and procedures for information security. We have also taken certain measures to mitigate cybersecurity risks, including, for example, cybersecurity awareness training for employees and management, periodic testing through simulated "phishing" campaigns (and require remedial training based on results) and the adoption of an incident response plan, vulnerability management policy and business recovery plan.


text: Furthermore, our information security function works with a security committee (the "Security Committee") to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business and evaluate material risks from cybersecurity threats against our overall business objectives. We use third-party service providers to perform a variety of functions throughout our business, such as CROs and contract manufacturing organizations (CMOs). Under our information security function, we perform risk and security assessments for certain of our vendors that involves a review of the vendor's written security program. Depending on the nature of the services provided, and the sensitivity of the Information Systems and Data at issue, and the identity or experience of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors" in Part I, Item 1A herein.


text: Our board of directors considers cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our Security Committee is comprised of key management stakeholders and experts, including our General Counsel, Chief Accounting Officer and Vice President of Ethics and Compliance and is chaired by our VP of IT, who has over 20 years of experience in strategic and operational IT/cybersecurity leadership and has received multiple cybersecurity certificates including (ISC)2, Cloud Security Alliance, Cisco Security and Microsoft Security Professional. The Security Committee is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The audit committee receives periodic reports from our VP of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. Under our incident response plan, certain incidents would also be reported to the board.


text: We have implemented and maintain a cybersecurity program that includes various processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software (collectively, "Information Systems"), and our critical data, including clinical trial and candidate data, intellectual property, and confidential information that is proprietary, strategic or competitive in nature (collectively with Information Systems, "Information Systems and Data").


text: Our program is designed and assessed using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which guides our approach to identifying, assessing, and managing material cybersecurity risks relevant to our business. While we use this framework to inform our cybersecurity practices, this does not imply compliance with any particular technical standards, specifications, or requirements.


text: Under this framework, our information security function, led by our Chief Information Officer, helps to identify, assess and manage the Company's cybersecurity threats and risks. This function helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example deploying automated tools in certain environments, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain aspects of the Company's threat environment, evaluating certain threats that are reported to us, conducting internal and external audits and internal threat assessment of certain environments, engaging third parties to conduct threat assessments, and conducting vulnerability assessments.


text: Furthermore, our information security function works with a security committee (the "Security Committee") to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business and evaluate material risks from cybersecurity threats against our overall business objectives. We use third-party service providers to perform a variety of functions throughout our business, such as CROs and contract manufacturing organizations ("CMOs"). Under our information security function, we perform risk and security assessments for certain of our vendors that involves a review of the vendor's written security program. Depending on the nature of the services provided, and the sensitivity of the Information Systems and Data at issue, and the identity or experience of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the vendor.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors - Our internal information technology systems, and those of our third-party CROs and other third parties upon which we rely, are subject to failure, security breaches and other disruptions, which could result in a material disruption of our investigational products' development programs, jeopardize sensitive information, prevent us from accessing critical information or result in a loss of our assets, and potentially expose us to notification obligations, loss, liability or reputational damage and otherwise adversely affect our business." in Part I, Item 1A herein.


text: Our Security Committee is comprised of key management stakeholders and experts and is chaired by our Chief Information Officer, who has over 20 years of strategic and operational IT/cybersecurity leadership experience and multiple cybersecurity certifications, from leading security organizations such as (ISC)2, Cloud Security Alliance, Cisco Security, Microsoft Security. The Security Committee is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The audit committee receives periodic reports from our Chief Information Officer concerning significant cybersecurity threats and risk and the processes we have implemented to address them. Under our incident response plan, certain incidents would also be reported to the board.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our cybersecurity program is managed by our Senior Vice President, Digital and Information Technology, or SVP of Digital and IT, whose team is responsible for leading our enterprise-wide cybersecurity policy, strategy, standards, and architecture.

companyName: Zentalis Pharmaceuticals, Inc.

ticker: ZNTL


text: Our cybersecurity program is aligned with industry standards and reasonable security safeguards for comparable companies in our industry. We also actively engage with industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We may engage consultants from time to time to assist us with assessing and improving our cybersecurity program.


text: The Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity program and receives periodic reports regarding the program. These reports include updates on our information security program and the status of projects to strengthen our information security systems. The Board also receives reports regarding cybersecurity risks.


text: Our management team, including our SVP of Digital and IT and our Chief Legal Officer, is responsible for assessing and managing our risks from cybersecurity threats. Certain members of our management team, including our SVP of Digital and IT and our Chief Legal Officer, are part of our Cyber Incident Response Team and are responsible for executing the processes set forth therein, including with respect to our third party service providers. Cybersecurity events are escalated to our Board as appropriate. Our management team's experience includes developing and overseeing the information technology security program as head of the information technology department and certification from the National Association of Corporate Directors for the Cyber-Risk Oversight Program.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity program is aligned with industry standards and reasonable security safeguards for comparable companies in our industry. We reference various security industry frameworks and other guidance to help us assess, identify and manage cybersecurity risks. We also actively engage with industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We may engage consultants or other third parties from time to time to assist us with assessing and improving our cybersecurity program.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See "Risk Factors—Risks Related to Employee Matters, Managing Our Growth and Other Risks Related to Our Business—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."


text: The Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and information security risks, including oversight of management's implementation of our cybersecurity risk management program. The Audit Committee receives periodic reports from management regarding our cybersecurity program. These reports include updates on our cybersecurity program and the status of projects to strengthen our information security systems. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, including our Chief Executive Officer, our Chief Legal Officer and our Executive Director, IT Infrastructure & Information Security, is responsible for assessing and managing our risks from cybersecurity threats. Certain members of our management team are part of our Cyber Incident Response Team and are responsible for executing the processes set forth therein, including with respect to our key third party service providers. Cybersecurity events are escalated to the Audit Committee or to our Board as appropriate. Our Executive Director, IT Infrastructure & Information Security, has close to thirty years of experience in information security, including twenty years of experience building and leading information security teams, and has held Certified Information Systems Security Professional certification from the International Information System Security Certification Consortium since 2002, as well as Qualified Technical Expert certification from the Digital Directors Network. Our Chief Executive Officer has thirty years of experience overseeing information technology, or IT, functions and has eight years of experience serving on the audit committees of companies that had oversight responsibility of the company's cybersecurity risk management program. Our Chief Legal Officer has overseen our IT team since 2023. Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our internal and customer facing information technology systems and confidential information. As part of this program, we prioritize maintaining the highest cybersecurity standards to safeguard information stored within our information technology systems. Our cybersecurity framework and controls are designed to align with key aspects of recognized best practices and standards for cybersecurity and information technology including industry standards based upon guidelines from the Center for Information Security ("CIS") and the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF"). Additionally, we incorporate guidance from the Federal Financial Institutions Examination Council ("FFIEC") to ensure we meet the expectations of our partners and any applicable regulatory requirements.

companyName: BM Technologies, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our enterprise risk assessment function, we have implemented processes to assess, identify, and manage the material risks facing the Company, including from cyber threats. Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our information technology systems and confidential information; • products and services built with security tools; • cybersecurity awareness training, including internal phishing tests of our employees, contractors, consultants, or any third-parties who will have access to our information technology systems and environment; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for key service providers, suppliers, and vendors based on their criticality and risk profile; and • a level of cybersecurity insurance that we believe is appropriate, taking into consideration the material risks from cybersecurity threats.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. For more information on our cybersecurity-related risks, see Item 1A - "Risk Factors."


text: The Company's information technology team is responsible for assessing and managing cybersecurity risks and has a depth of experience focused on increasing the Company's resilience to security threats and stays current on new developments through monitoring of the cybersecurity landscape. The Company's information technology environment is actively monitored for potential security threats, and security events are investigated and acted on to minimize potential risk to the environment.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. The Board of Directors receives periodic reports from management on our cybersecurity risks and program. In addition, management updates the Board of Directors, as necessary, regarding any significant cybersecurity incidents.


text: Our enterprise (the holding company and its operating subsidiaries) is using technology in virtually all aspects of the business. Much like many other businesses, certain of our subsidiaries' information systems have been subject to computer viruses, malicious codes, unauthorized access, and other cyberattacks. We expect to be subject to similar attacks in the future as such attacks become more sophisticated. A significant disruption or failure of our technology systems could result in service interruptions, safety failures, security events, regulatory compliance failures, an inability to protect information and assets against unauthorized users, and other operational difficulties. Attacks perpetrated against our systems could result in loss of assets and critical information and expose us to remediation costs and reputational damage.

companyName: Biglari Holdings Inc.

ticker: BH-A


text: Cyberattacks could compromise confidential customer and employee information. Cyberattacks may result in business interruptions, lost revenues, higher commodity prices, disruption in fuel supplies, lower energy consumption, unstable markets, increased security, repair or other costs, or may materially adversely affect us in ways that cannot be predicted at this time.


text: Our operating businesses are managed on an unusually decentralized basis. There are few centralized or integrated business functions. Consistent with our decentralized management philosophy, our operating businesses individually establish specific practices concerning cybersecurity risks. Although our subsidiaries have taken steps intended to mitigate these risks, including business continuity planning, disaster recovery planning, and business impact analysis, a significant disruption or cyber intrusion at one or more of our significant operations could adversely affect our results of operations, financial condition, and liquidity. Additionally, if we are unable to acquire, develop, implement, adopt, or protect rights around new technology, we may suffer a competitive disadvantage, which could also have an adverse effect on our results of operations and financial condition. Given the wide variations in the nature and size of business activities, specific practices may vary widely among our operating subsidiaries.


text: We have developed and implemented a cybersecurity program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity program includes a cybersecurity incident response plan.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity program is integrated into our overall risk management program and includes reporting channels to the executive management team and an internal Cybersecurity Oversight Committee, as well as governance processes which communicate cybersecurity risks to departments across the organization, including legal, strategic, operational, and financial areas. This encourages consideration of cybersecurity oversight, accountability and diligence across the organization.


text: Our cybersecurity program includes: • Processes to assess cybersecurity risk, designed to help identify material cybersecurity risks to critical systems, information, products, services, and the broader enterprise information technology environment; • a security team principally responsible for coordinating and managing (1) cybersecurity risk evaluation processes, (2) implementation of cybersecurity controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of the organization's cybersecurity controls; • cybersecurity awareness training of employees, incident response personnel, including third party providers, and senior management; • a cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to sensitive data or information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the organization, including operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors— Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security breaches, which could result in a material disruption of our seralutinib development program, which could materially affect our results."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity program.


text: The Audit Committee receives formal annual reports from management regarding cybersecurity risks. In addition, management updates the Board and Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team including the Executive Vice President, Technical Operations and Administration is responsible for assessing and managing material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes collective decades of experience working in and overseeing information technology and cybersecurity functions, technical cybersecurity certifications, and active membership in cybersecurity professional organizations, as well as local groups, to support knowledge sharing and ongoing education.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in the information technology environment.


text: We have developed and implemented a cybersecurity governance program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity governance program includes reporting channels to the executive management team and an internal Cybersecurity Oversight Committee, as well as governance processes which communicate cybersecurity risks to departments across the organization, including legal, strategic, operational, and financial areas. This encourages consideration of cybersecurity oversight, accountability and diligence across the organization.


text: Key elements of our cybersecurity governance program includes but are not limited to the following: • Processes to assess cybersecurity risk, designed to help identify material risks from cybersecurity threats to critical systems and information; • a security team principally responsible for coordinating and managing (1) cybersecurity risk evaluation processes, (2) implementation of cybersecurity controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of the organization's cybersecurity processes; • cybersecurity awareness training of employees, including incident response personnel including third party providers, and senior management; • a cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the organization, including operations, business strategy, results of operations, or financial condition. See "Risk Factors - Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or Chiesi or potential future collaborators, may fail or suffer security breaches, which could result in a material disruption of our seralutinib development program, which could materially affect our results."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risks, including oversight of management's implementation of the cybersecurity governance program.


text: The Audit Committee receives formal annual reports from IT management regarding cybersecurity risks. In addition, management would update the Audit Committee and Board, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Assessment and management of material risks from cybersecurity threats are performed by the Executive Director, Information Security, Risk & Compliance and the Vice President, IT and Facilities, reporting to the Executive Vice President, Technical Operations and Administration. Our Executive Vice President, Technical Operations and Administration reports to the President and Chief Executive Officer. This group holds primary responsibility for our overall cybersecurity governance program, along with our internal Cybersecurity Oversight Committee, which includes senior personnel from key departments in the organization. The collective experience of the individuals listed above, along with the Cybersecurity Oversight Committee, includes decades of experience working in and overseeing IT and cybersecurity functions and enterprise, IT and cybersecurity risk management functions, in addition to holding active technical cybersecurity certifications and maintaining active membership in cybersecurity professional organizations, as well as local groups, to support knowledge share and ongoing cybersecurity professional development.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in our IT environment.


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. As a result, we have integrated cybersecurity risk management into our broader risk management framework to promote a holistic approach toward assessing, identifying, and managing material risks associated with cybersecurity threats. This integration ensures that cybersecurity considerations are an integral part of the decision-making processes at every level of our organization.

companyName: Piedmont Lithium Inc.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we have partnered with third-party cybersecurity agencies to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our cybersecurity partners work to continuously scan and monitor our networks for threats and vulnerabilities and provide access to a 24/7 incident response team. Further, through our partnerships, we conduct annual security risk assessments, which are designed in alignment with the National Institute of Standards and Technology Cybersecurity Framework and perform annual penetration tests and breach and attack simulations to validate security controls. These partnerships are actively managed by members of our management team, together with our information technology department, to ensure effective implementation.


text: Additionally, to best position Piedmont Lithium to avoid cybersecurity incidents, we, among other things, conduct employee trainings and, where appropriate, utilize a coordinated procurement process to bring consistency, compliance, and interoperability to the hardware, software, and services we obtain from vendors and other business partners. This coordinated procurement process includes, in addition to other safeguards, review by our information technology and legal departments to address any security concerns before any vendor or business partner is granted access to our information systems.


text: As of the date of this Annual Report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. For additional information, refer to Part I, Item 1A, "Risk Factors—Our business is subject to cybersecurity risks."


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management team. Our Audit Committee is responsible for the Board-level oversight of risks from cybersecurity threats. Members of our Audit Committee receive updates from our management team regarding Company practices, programs, and other developments related to cybersecurity throughout the year, including quarterly updates from our Chief Legal Officer on cyber threats and our cybersecurity risk management and strategy program. Our Audit Committee is comprised of Board members with diverse expertise, including risk management and strategy, equipping each member to oversee cybersecurity risks effectively.


text: We maintain a Cybersecurity Incident Response Team composed of professionals across various functions, including information technology, legal, finance, accounting, and risk. This team is trained in managing cybersecurity incidents and is comprised of individuals with experience in various roles involving information technology, including, security, auditing, compliance, systems, and programming.


text: Cyber criminals are becoming more sophisticated and effective every day, and all companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing our systems and data a top priority. Our Board and our management are actively involved in our overall enterprise risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, procedures and processes for assessing, identifying, and managing material risks from cybersecurity threats. There can be no guarantee that our policies, procedures and processes will be properly followed in every instance or that those policies, procedures and processes will be effective. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us. For more information about risks relating to cybersecurity matters see "Item 1A. Risk-Factors—General Risk Factors—We may be vulnerable to security breaches or cyber attacks which could disrupt our operations and have a material adverse effect on our financial condition and operating results."

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: Our policies, procedures and processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall enterprise risk management program. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Personnel primarily responsible for security, risk and compliance matters meet periodically to develop strategies for preserving the confidentiality, integrity and availability of Company and tenant information, identifying, preventing and mitigating cybersecurity threats, and responding to any cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: At least annually, we, with the assistance of an external cybersecurity consultant, conduct a cybersecurity risk assessment that takes into account information from internal personnel, known potential information security vulnerabilities and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, its Nominating and Corporate Governance Committee, and members of management.


text: Technical Safeguards We periodically assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are periodically evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: We have established comprehensive incident response and recovery plans and continue to periodically test and evaluate the effectiveness of those plans. Our incident response and recovery plans address—and guide our employees, management and the Board on—our response to a cybersecurity incident.


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of engagement, contract renewal and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties, and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness Each of our employees is required to comply with our cybersecurity policies. We regularly remind employees of the importance of handling and protecting our data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: External Assessments Our cybersecurity policies and procedures are periodically assessed by our external cybersecurity consultant. These assessments include a variety of activities including information security maturity assessments, penetration tests, and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to management, the Board and its Nominating and Corporate Governance Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: Our Board, in coordination with its Nominating and Corporate Governance Committee, oversees our management of cybersecurity risk. They receive periodic reports from management and our external cybersecurity consultant about the identification, prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Nominating and Corporate Governance Committee directly oversees our cybersecurity program. The Nominating and Corporate Governance Committee receives periodic updates from management and our external cybersecurity consultant on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Our chief financial officer ("CFO") has primary responsibility for assessing and managing material risks from cybersecurity threats. The CFO meets periodically with our external cybersecurity consultant to review security performance metrics and identify security risks. The CFO and our external cybersecurity consultant also consider and make recommendations on security policies and procedures, security service requirements and risk mitigation strategies to the Nominating and Corporate Governance Committee.


text: Our Board, in coordination with its Nominating and Corporate Governance Committee, oversees our management of cybersecurity risk. They receive periodic reports from management and our external cybersecurity consultant about the identification, prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Nominating and Corporate Governance Committee oversees risks arising from our cybersecurity program. The Nominating and Corporate Governance Committee receives periodic updates from management and our external cybersecurity consultant on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Our Chief Financial Officer has primary responsibility for assessing and managing material risks from cybersecurity threats. The Chief Financial Officer meets periodically with our external cybersecurity consultant to review security performance metrics and identify security risks. The Chief Financial Officer and our external cybersecurity consultant also consider and make recommendations on security policies and procedures, security service requirements and risk mitigation strategies to the Nominating and Corporate Governance Committee.


text: To prevent, detect and respond to information security threats, the Manager maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO") with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Manager, receives regular reports from the CISO on, among other things, the Manager's cyber risks and threats, the status of projects to strengthen the Manager's information security systems, assessments of the Manager's security program and the emerging threat landscape.

companyName: Grayscale CoinDesk Crypto 5 ETF

ticker: GDLC


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Manager's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board of the Manager about any information security incidents that may pose a material risk to the Manager. The Manager contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.


text: The Manager's Security Awareness Program includes training that reinforces the Manager's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Manager's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: The Manager administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: There have not been any breaches at the Manager or the Fund during the year ended June 30, 2025. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity and availability of our critical systems and information. Our program includes processes for identifying, assessing and managing material risks from cybersecurity threats that are guided by the National Institute of Standards & Technology's Cyber Security Framework, the ISO 27001 international standard for information security and other applicable industry benchmarks.

companyName: Broadcom Inc.

ticker: AVGO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management system and processes, and includes: • a team of professionals within our Global Technology Organization team who are responsible for identifying and mitigating cybersecurity risks and managing our security controls and response activities; • risk assessment processes designed to identify cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • an annual tabletop exercise to simulate a response to a cybersecurity incident; and • mandatory training annually and upon hiring for all employees on data privacy and cybersecurity topics.


text: When appropriate, we utilize independent, external service providers to assess, test or otherwise assist with certain aspects of our cybersecurity risk management program and related processes, including for penetration testing, threat monitoring and incident response. We also employ a vendor risk assessment process to mitigate risks presented by certain third-party service providers, and we require such providers to manage their cybersecurity risks in conformance to industry standards, notify us of relevant cybersecurity events and satisfy additional contractual requirements.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See Item 1A. Risk Factors, "Cyber security threats or other security breaches, or any other impairment of the confidentiality, integrity or availability of our IT systems, or those of one or more of our corporate infrastructure vendors, could have a material adverse effect on our business" in this Annual Report on Form 10-K for additional information about our cybersecurity-related risks.


text: Our Board of Directors is actively involved in overseeing our cybersecurity risk management and shares oversight responsibility and processes with the Audit Committee of the Board of Directors (the "Audit Committee").


text: Our management, including our Chief Information Officer ("CIO"), in consultation with our Chief Information Security Officer ("CISO"), reviews with the Audit Committee at least quarterly our cybersecurity security policies, practices and protective measures, threat intelligence, cybersecurity incidents and related risks. At least quarterly, our CIO also provides the Audit Committee with an update on our enterprise security program that includes procedures and policies for testing vulnerabilities, responding to cybersecurity threats, and training and evaluating our employees. The Audit Committee and management also update our Board of Directors at least quarterly on our cybersecurity performance and risk profile and the effectiveness of our cybersecurity processes.


text: Our management, including our CIO and CISO, are responsible for assessing and managing material risks from cybersecurity threats. Our CIO oversees our Global Technology Organization that has primary responsibility for our overall cybersecurity risk management program. Our CIO, who reports to our Chief Executive Officer, has over 20 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution. Our CISO, who reports to the CIO, has approximately 30 years of cybersecurity experience assessing and managing cybersecurity programs.


text: Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity and availability of our critical systems and information. At any given time, we face cybersecurity risks and threats, some of which are not fully mitigated, and we routinely address newly discovered vulnerabilities. We continuously work to enhance our information security program and risk management efforts. Our program includes processes for identifying, assessing and managing material risks from cybersecurity threats that are guided by the National Institute of Standards & Technology's Cybersecurity Framework, the ISO 27001 international standard for information security and other applicable industry benchmarks.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management system and processes, and includes: • a team of professionals within our Global Technology Organization who are responsible for identifying and mitigating cybersecurity risks and managing our security controls and response activities; • risk assessment processes designed to identify cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • an annual tabletop exercise to simulate a response to a cybersecurity incident; and • mandatory training annually and upon hiring for all employees and contractors on data privacy and cybersecurity topics.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about our cybersecurity-related risks, see Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our management, including our Chief Information Officer ("CIO"), in consultation with our Chief Information Security Officer ("CISO"), reviews with the Audit Committee quarterly, or more frequently as determined to be necessary or advisable, regarding our cybersecurity security policies, practices and protective measures, threat intelligence, cybersecurity incidents and related risks. At least quarterly, our CIO also provides the Audit Committee with an update on our enterprise security program that includes procedures and policies for testing vulnerabilities, responding to cybersecurity threats, and training and evaluating our employees. The Audit Committee and management also update our Board of Directors at least quarterly on our cybersecurity performance and risk profile and the effectiveness of our cybersecurity processes. We also have protocols in place for escalating certain cybersecurity incidents to the Audit Committee and the Board of Directors.


text: Our information security function is led by our Executive Director of Global IT Operations ("Head of IT"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: Autolus Therapeutics plc

ticker: AUTL


text: The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, and conducting vulnerabilities assessments. In addition, our employees and contractors receive periodic training under our IT security policies, including simulated intrusion attempts, and are required to certify compliance with our cybersecurity practices.


text: Depending on the environment or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an information security policy, access management procedures, data back-up and restoration policy, cyberattack response procedure, network security controls, data segregation for certain data, encryption of certain data, access controls, physical controls, systems monitoring, penetration testing, employee training, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, cybersecurity service providers, and penetration testing services. The results of those assessments and reviews are reported to senior management and the board of directors, including the Audit Committee, by the Head of IT, as appropriate.


text: In addition, updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape may also be reported to senior management and the board of directors, including the Audit Committee, by the Head of IT, as appropriate. Our senior management team and board of directors include several members with operational experience overseeing IT operations, including risk assessment and implementation of security measures. As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: We use third-party service providers to perform a variety of functions throughout our business, such as CROs, contract manufacturing organizations, and other distributors, including those who process clinical trial data on our behalf. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, a review of security assessments and imposition of contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Management is responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our Head of IT and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. Management regularly updates the board of directors on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides regular cybersecurity updates.


text: Our board of directors has overall oversight responsibility for our risk management and is charged with oversight of our cybersecurity risk management program. The board is responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess and respond to cybersecurity, data privacy and other information technology risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity threats and incidents.


text: Our information security function is led by our Chief Information Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.


text: The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, and conducting vulnerabilities assessments. In addition, our employees and contractors receive periodic training under our IT security policies, including simulated intrusion attempts, and are required to certify compliance with our cybersecurity practices. In February 2025, we obtained ISO 27001 certification for our information security management systems.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our board of directors has overall oversight responsibility for our risk management and has charged our Audit Committee with oversight of our cybersecurity risk management program. The board and Audit Committee are responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess and respond to cybersecurity, data privacy and other information technology risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity threats and incidents.


text: Cybersecurity is one of the cornerstones of our strategic business plan and the driving force behind our digital transformation journey. As a financial institution, we confront a spectrum of cyber threats, ranging from common attacks like ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners, emphasizing the critical need for a robust cybersecurity stance. In light of these challenges, maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and maintaining customer confidence in our banking services.

companyName: BayCom Corp

ticker: BCML


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk appetite with our strategic objectives. Our enterprise risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Director of Information Technology leads our cybersecurity program, reporting directly to the Chief Operating Officer ("COO") and provides reports and updates to the Audit Committee, the Enterprise Risk Committee and the Chief Risk Officer ("CRO") quarterly or more frequently as required.


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our Information Security Program aligns with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool, and is periodically reviewed and updated at least annually or more frequently upon significant changes to our operating environment. Our Information Security Program is led by our Information Security Officer in conjunction with our Director of Information Technology.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The IRP is coordinated through the Director of Information Technology, COO, CRO, and key members of management and addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements.


text: We rely on a series of processes to identify threats, hazards, and other risks to our information assets. We employ a variety of preventative and detective tools from our Managed Security Services provider designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, including directly into patch and vulnerability management tools. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness. We have regular and ongoing security education and training for employees and recovery and resilience tests. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis. All risk and security assessments results are shared with the Board of Directors.


text: Our assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our Information Technology teams meet to ensure that risks are timely identified, patch and vulnerability requirements are monitored, and the necessary changes are implemented.


text: Our Information Technology Governance ensures alignment between the Bank's technological strategy and business goals. We strive for efficient utilization of IT resources while effectively managing IT risks within the Bank's risk appetite. Additionally, our robust Vendor Management Program ensures proper oversight during the onboarding of new products, projects, and third-party vendors.


text: Identified Cybersecurity Risks Federal regulators have issued multiple statements and guidance regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised client credentials, including security measures to reliably authenticate clients accessing internet-based services of the financial institution. In addition, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the timely recovery, resumption and maintenance of the institution's operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to a cyber-attack. If a financial institution fails to observe the regulatory guidance, they could be subject to various regulatory sanctions, including financial penalties.


text: State regulators have also been increasingly active in implementing cybersecurity standards and regulations. Recently, several states have adopted laws and/or regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many such states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue, and we continue to monitor relevant legislative and regulatory developments.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations to store and transmit sensitive data. We employ a layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our clients and third-party service providers are under constant threat and there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our clients. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity. See "Risks Related to Cybersecurity, Third Parties and Technology" under "Item 1A. Risk Factors" in this Form 10-K for a further discussion of risks related to cybersecurity.


text: Management and Board Oversight of Cybersecurity Risks Our Cybersecurity Program is managed by the Director of Information Technology who leads our Information Technology team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Information Technology provides periodic reports to the executive risk management committee and the board-level risk committees of the Company and the Bank and the Chief Executive Officer and other members of our senior management, as well as the cross-functional management team that oversees the information security and information technology programs. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents. The Chief Operating Officer, Chief Risk Officer, and board-level risk committees of the Bank provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.