text: The Company engages third parties to perform periodic assessments of certain aspects of our cybersecurity measures, including vulnerability assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Nominating and Governance Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board of Directors has delegated oversight of cybersecurity risks to our Nominating and Governance Committee. Executive management, inclusive of our Vice President of IT ("VP of IT") in conjunction with our National Vice President of Finance ("NVP of Finance"), provides regular updates to the Nominating and Governance Committee including any updates to our program in response to new or changed cybersecurity risks, as well as ongoing metrics around the effectiveness of our existing cybersecurity strategies.

companyName: Dream Finders Homes, Inc.

ticker: DFH

secItem: Item 1C


text: The VP of IT and the NVP of Finance work in coordination with the Cybersecurity Response Committee, which also includes our Chief Financial Officer and representatives from legal, internal audit and SEC reporting functions. In the event of a cyber incident, the Cybersecurity Response Committee utilizes a formal incident response plan based on the NIST Framework to assess and manage cybersecurity threats. The incident response plan encompasses the containment, eradication, recovery, and resolution processes for the incident, while also detailing the individuals and groups that need to be notified.


text: The VP of IT has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of a healthcare company and a member of the cyber emergency response team at several companies. The VP of IT holds undergraduate and graduate degrees in computer science and has attained various professional certifications in cybersecurity. The NVP of Finance and the rest of the Cybersecurity Response Committee hold undergraduate and graduate degrees in their respective fields, and have over 50 years of collective experience managing enterprise risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats have not materially affected the Company, including our business strategy, results of operations or financial condition, to date. Risks relating to cybersecurity threats and potential impacts to our business strategy, results of operations or financial condition are discussed in "Risk Factors" herein.


text: Our Board of Directors oversees risk management for the Company, including through its approval of the investment policy and other policies of the Company and its oversight of the Adviser. For certain risks, our Board of Directors has delegated oversight responsibilities to committees of our Board of Directors. For example, the Nominating and Corporate Governance Committee assists our Board of Directors with assessing risks associated with conflicts of interest. Cybersecurity risk management is integrated into this broader risk management framework. Our Board of Directors has delegated to the Audit Committee oversight of management's programs and policies to identify, assess, manage, mitigate and monitor significant business risks of the Company, including privacy, information technology and cybersecurity risks.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Adviser, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and its program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President and Chief Risk and Transformation Officer, has 28 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 12 years. In addition, the CISO provides regular briefings for our Board of Directors and senior officers of the Company on cybersecurity matters, including on threats, events, and program enhancements. The Chief Compliance Officer of the Company also provides periodic updates to our Board of Directors and senior officers of the Company on cybersecurity threats and material risks from cybersecurity threats with respect to the Company.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Adviser uses to provide services to us pursuant to the Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or their delegee. In addition, senior officers of the Company have implemented a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or may impact the Company, including by impacting the Adviser's ability to provide services to the Company pursuant to the Advisory Agreement. Pursuant to this policy, the Adviser and Franklin Templeton are required to notify and update the Company's senior officers and our Audit Committee with respect to certain matters related to cybersecurity incidents specified under the policy.


text: The Audit Committee oversees, on behalf of our Board of Directors, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. On a quarterly basis, the CISO or their delegee report to our Board of Directors or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Franklin Templeton cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from and reporting cybersecurity events. The Company has a policy that supplements the Franklin Templeton cybersecurity incident response plan and addresses reporting and disclosure considerations related to a cybersecurity incident.


text: Prevention and Preparation Franklin Templeton undertakes regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and they implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, Franklin Templeton periodically engages consultants to conduct external reviews of its vulnerabilities, including penetration testing and compromise assessments. Franklin Templeton employs best practice identity and access management including broad adoption of multifactor authentication, geo-location blocking, behavior analytics and controls aligned to a zero trust model.


text: Franklin Templeton and the Adviser recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of their prevention efforts is employee training on their data privacy and cybersecurity procedures. For example, all new hires of Franklin Templeton and the Adviser receive mandatory privacy and information security training. In addition, current employees of the Adviser must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related testing and trainings that the Adviser conducts throughout the year.


text: We recognize that third parties that provide information systems used by the Adviser to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton maintains a vendor code of conduct, which is designed to require third party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. All third party vendors must complete a cyber incident reporting questionnaire to ensure timely notification of any potential cybersecurity breaches. Third-party IT vendors are also subject to additional diligence requirements.


text: As discussed above, to support its preparedness, Franklin Templeton has an incident response plan that it regularly updates. In addition, Franklin Templeton performs regularly scheduled tabletop exercises and periodic drills at least once a year to test its incident response procedures, identify improvement opportunities and exercise team preparedness. Franklin Templeton also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt its network or networks of its vendors, in all cases up to specified limits and subject to certain exclusions.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a comprehensive threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is initially focused on containing the cybersecurity incident as quickly as possible consistent with the procedures in the incident response plan. Containment procedures may include off-lining systems, including by disconnecting network cable, utilizing network-management tools to isolate the host, altering the DNS entry of impact hosts, and coordinating with service providers.


text: Once a cybersecurity incident is contained the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, and increased network monitoring or logging to identify recurring attacks.


text: Franklin Templeton has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts, including a forensic investigation firm, a ransomware recovery vendor, a communications firm, and various law firms.


text: Following the conclusion of an incident, the Franklin Templeton incident response team will generally reassess the effectiveness of the cybersecurity program and incident response plan, make adjustments as appropriate and report to our senior management and Audit Committee on these matters.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Adviser routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Adviser and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Adviser uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See "Item 1A–Risk Factors– Our business could suffer in the event our Adviser or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Adviser, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Amended and Restated Investment Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and its program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President and Chief Risk and Transformation Officer, has 30 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 13 years. In addition, the CISO provides regular briefings for our Board of Directors and senior officers of the Company on cybersecurity matters, including on threats, events, and program enhancements. The Chief Compliance Officer of the Company also provides periodic updates to our Board of Directors and senior officers of the Company on cybersecurity threats and material risks from cybersecurity threats with respect to the Company.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Adviser uses to provide services to us pursuant to the Amended and Restated Investment Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or their delegee. In addition, senior officers of the Company have implemented a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or may impact the Company, including by impacting the Adviser's ability to provide services to the Company pursuant to the Amended and Restated Investment Advisory Agreement. Pursuant to this policy, the Adviser and Franklin Templeton are required to notify and update the Company's senior officers and our Audit Committee with respect to certain matters related to cybersecurity incidents specified under the policy.


text: We recognize that third parties that provide information systems used by the Adviser to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton requires third party vendors to comply with our confidentiality, security, and privacy requirements. All third party vendors must complete a cyber incident reporting questionnaire to ensure timely notification of any potential cybersecurity breaches. Third-party vendors are also subject to additional diligence requirements.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a comprehensive threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is initially focused on containing the cybersecurity incident as quickly as possible consistent with the procedures in the incident response plan.


text: Franklin Templeton has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Adviser routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Adviser and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Adviser uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See "Item 1A.–Risk Factors– Our business could suffer in the event our Adviser or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."


text: The Company and the broader financial services industry face an increasingly complex and evolving threat environment.

companyName: SL Investment Corp.


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Adviser and the Administrator manage the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and stockholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley forensics team, which develops and implements technologies designed to help detect these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Where a potential threat is identified in Morgan Stanley's environment or which impacts the Company, Morgan Stanley's incident response team evaluates the potential impact to the Firm and, as relevant, the Company, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department, review external cybersecurity incidents that may be relevant to the Firm and the Company, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular training exercises for its employees and consultants, including those personnel relied upon by the Company.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Risk, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company. Those processes are periodically tested through tabletop exercises.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally and relies on the CIO, CISO, and Head of Operational Risk to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of Operational Risk has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of Operational Risk report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, the CISO, and the Head of Operational Risk, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2023, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations.

companyName: Carriage House Event Center, Inc.


text: Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks.


text: The Cooperative's Board of Directors recognizes the significance that cybersecurity has on our business, particularly the security of our member data, and is responsible for overseeing risks to the Cooperative from cybersecurity threat actors. Our operations rely party providers. These systems collect, process, transmit and retain information that may require both mandatory and voluntary data protection regimens.

companyName: Golden Growers Cooperative

ticker: GGROU


text: Our cybersecurity practices are designed to provide reasonable information security given the nature of our organization and our third-party relationships. We rely on the representations third-party relationships introduce additional cybersecurity risks. To address these third-party risks, we have established strict criteria for supplier selection and conduct security risk assessments to mitigate potential impacts on our business.


text: The Cooperative's Board of Directors contracts with a Managed Security Service Provider. Our Managed Security Service Provider services include: (i) managed IT services, consisting system monitoring and reporting; and (ii) cyber security services, consisting of firewall management, intrusion detection and prevention, malware and virus protection, security audits and vulnerability assessments, security incident response, and employee awareness training. In addition, our Managed Security Service Provider conducts risk assessments and provides recommendations to the Executive Vice President and the Board of Directors, provides threat containment and mitigation services, assists the Cooperative with cybersecurity compliance, and would coordinate with insurance carriers and law enforcement in the event of a cybersecurity incident.


text: The Cooperative's Board of Directors believes a strong cybersecurity strategy is vital to protect our business operations, sustain our control environment and honor our data protection obligations. The Board has delegated to its Finance & Audit Committee the responsibility for monitoring the effectiveness of the Cooperative's internal cybersecurity practices. The Executive Vice President manages the Cooperative's cybersecurity-related risks, communicates with suppliers and other third party providers regarding cybersecurity threats, incidents, plans and responses, and reports to the Finance & Audit Committee and/or the entire Board regarding such cybersecurity threats, incidents, plans and responses on at least a semi-annual basis, and more often as needed.


text: 2024, the Cooperative did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Cooperative, including its business strategy, results of operations, or financial condition.


text: The Company does not have any processes for identifying and managing material risks from cybersecurity threats. The Company considers that at the current stages of its development and information systems there are no risks of cybersecurity incidents that have materially affected and are reasonably likely to materially affect the company, including its business strategy, results of operations, or financial condition.

companyName: NIKA PHARMACEUTICALS, INC

ticker: NIKA


text: Because the Company is not reasonably likely to be materially affected by cybersecurity threats at the current stages of its development, there are no particular director's oversight of risks from cybersecurity threats and management does not have an active role in assessing and managing the Company's material risks from cybersecurity threats.


text: Risk Management and Strategy Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to regularly and promptly inform management and our Board of Directors of any significant cybersecurity risks and developments.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: Our company currently does not have a Chief Information Security Officer ("CISO") due to our size; our Director of Operations ("DO"), with assistance from our third-party information technology ("IT") support firm, leads the Company's effort in establishing cybersecurity strategies and structures and helps identify, assess, and manage the Company's cybersecurity threats and risk. Our DO regularly meets with our third-party IT support firm to discuss cybersecurity threats and risk. This team helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools, for example, phishing and social engineering tests.


text: We have worked, and expect to continue to work, with third-party service providers, as appropriate, to assess, identify and manage cybersecurity risks. As such, our DO meets with the senior management from our IT support firm regularly to discuss work requests and issues raised that may need to be added to the network for security. We also conduct periodic and on-demand assessments of our cybersecurity risk management program with expert service providers to ensure it remains current, given the changing risk environment. The DO regularly updates cybersecurity matters to the executive management team.


text: We use third-party service providers to perform a variety of critical functions throughout our business, such as hosting providers, application providers, contract research organizations and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our DO. Our DO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant employees and personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our DO, with the appropriate members of management, will work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Cybersecurity risks are overseen by the Board of Directors and the Audit Committee. The Audit Committee is central to the Board of Directors' oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major cybersecurity initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: Our DO provides comprehensive updates to the Audit Committee quarterly and the full Board of Directors at least annually. These briefings have included a range of topics, such as: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.


text: As of the date of this report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Risk Management and Strategy Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. We recognize the importance of developing, implementing, and maintaining cybersecurity measures that are designed to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity in an effort to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to inform management and our Board of Directors of any significant cybersecurity risks and developments.


text: Our Senior Director of Operations ("DO"), with assistance from our third-party information technology ("IT") support firm, leads the Company's effort in establishing cybersecurity strategies and structures that help to identify, assess, and manage the Company's cybersecurity threats and risk. Our DO working knowledge of end-user best practices and regularly meets with our third-party IT support firm to discuss potential cybersecurity threats and risk. This team helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools, for example, phishing and social engineering tests. Based on these meetings, our DO identifies additional end-user education and company security needs, which are supported through our IT support firm or other third-party IT experts.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our DO, with the appropriate members of management, will work with the Company's incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the Board of Directors ("Audit Committee") for certain cybersecurity incidents.


text: Cybersecurity risks are overseen by the Audit Committee. The Audit Committee is central to the Board of Directors' oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major cybersecurity initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: Our DO provides comprehensive updates to the Audit Committee and the full Board of Directors at least annually. These briefings have included a range of topics, such as: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.


text: The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.


text: We are committed to safeguarding our customers and the sensitive information shared in the application of software and services provided. Our cybersecurity program, risk management and governance reflect our dedication to not only meeting industry standards but exceeding them.

companyName: Certara, Inc.

ticker: CERT


text: We recognize that cybersecurity risks pose a significant threat to our business, customers, and stakeholders, and we have implemented a comprehensive security and privacy program to address these risks. We embed security considerations into every aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to emerging threats to ensure that our customers' information remains secure in the face of evolving cybersecurity challenges. With a foundation grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 20, OWASP Top 10, and Security by Design, we prioritize the identification and assessment of risks to create a protective shield around our customers' data.


text: This foundation guides our processes for assessing, identifying, and managing risks related to cybersecurity threats and incidents, as well as ensuring compliance with legal and contractual obligations. Our risk management processes are integrated into our overall business strategy and operations. We use various methods and tools to identify and assess cybersecurity risks across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers. We also use third-party assessors and service providers, consultants, and auditors, to support our risk management processes and to provide independent validation and verification of our security posture. We have established processes to oversee and identify risks associated with our use of third-party assessors and service providers, such as due diligence, contractual obligations, monitoring and vendor evaluation and qualification.


text: We maintain robust cybersecurity incident response procedures, which includes escalating incidents to the appropriate level of management, mitigation, remediation and the assessment of materiality of cybersecurity incidents, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We also disclose information regarding our security and privacy program and practices on our website and in our public-facing notices.


text: Furthermore, we conduct annual cybersecurity awareness training for our employees in order to provide them with the knowledge necessary to navigate the digital landscape securely. We understand that cybersecurity is not a static concept but a dynamic discipline, and our security and privacy program reflects this by incorporating internal and third-party audits, penetration testing, active vulnerability scanning and a continuous improvement mindset.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, or a series of related incidents, that have had or are reasonably likely to have a material impact on the Company's business strategy, results of operations or financial condition. For more information on our cybersecurity related risks, see Part 1, Item 1A. Risk Factors entitled "Risks Related to Intellectual Property, Information Technology and Data Privacy" included elsewhere in this Annual Report on Form 10-K.


text: We have established a corporate governance structure that provides oversight and guidance for our security and privacy program. The Board of Directors (the "Board") is ultimately responsible for the oversight of the Company's security and privacy program. The Audit Committee, which supports the Board in the oversight of the program, is focused on cybersecurity and data privacy risk, including incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.


text: We have defined roles and responsibilities for the management of cybersecurity risks, including specific executive-level and management-level positions or committees. Our security and privacy program is overseen by our Security and Privacy Program Office ("SPPO"), which is composed of corporate leadership from legal and IT. The SPPO is accountable to the VP of Information Technology, who is the accountable executive for the program. Our function and business unit executive leadership, acting in support of the SPPO and the Board, is responsible for ensuring organizational compliance with data protection regulations and controls across the organization. Our VP of Information Technology and Director, Compliance Standards & Data Privacy ("DCSDP"), are responsible for the design, implementation, and monitoring of the security and privacy policies, standards, procedures, and controls that govern our information systems and data processing activities. Our VP of Information Technology, has 30 years of experience in IT infrastructure, cybersecurity operations, and site reliability engineering for a wide range of software and service organizations, with the last 15 years focused on SaaS software businesses with access to sensitive customer data. The DCSDP also has 30 years in IT with the last 12 focused on compliance and data privacy issues for Certara.


text: The VP of Information Technology and DCSDP also have a reporting responsibility to the General Counsel, and the Board via the Audit Committee. They coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the SPPO, the Board, the Audit Committee, and other stakeholders on a quarterly basis, or more frequently as needed.


text: We have established processes to ensure that management is informed about and monitors cybersecurity incident prevention, detection, mitigation, and remediation. These processes include regular reporting, escalation, and communication protocols, as well as periodic reviews and audits of the security and privacy program.


text: We are committed to safeguarding our customers' information that is shared with us in the application of the software and services we contractually provide to them. Our information systems, including our cybersecurity program, risk management systems and processes and governance, reflect our dedication to meeting industry cybersecurity standards.


text: We have implemented a comprehensive cybersecurity and data privacy program as part of our risk management processes to assess, identify and manage risks posed to our business by cybersecurity threats. We embed cybersecurity considerations into every material aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to cybersecurity threats. Our cybersecurity risk management processes are grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 18, OWASP Top 10, and Security by Design and are intended to prevent adverse effects on the confidentiality, integrity and availability of our information systems and information residing therein.


text: Our cybersecurity processes have been integrated into our risk management processes in order for us to assess, identify, and manage risks related to cybersecurity threats and ensure compliance with our legal and contractual obligations, which require us to safeguard the confidential and sensitive information provided to us by our customers. For example, we use various methods and tools to identify and assess cybersecurity threats across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers. We regularly engage third-party assessors, service providers, consultants, and auditors to support and review our risk management processes and to provide independent validation and verification of our security posture. We have established processes to oversee and identify risks from cybersecurity threats associated with our use of third-party assessors and service providers, such as due diligence, contractual language, monitoring and periodic vendor evaluation and qualification.


text: We maintain robust cybersecurity threat procedures, which includes escalating threats to the appropriate level of risk management, mitigation, remediation and the assessment of materiality of cybersecurity threats, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We disclose information regarding our cybersecurity and privacy program and practices on our website and in our public-facing notices.


text: As of December 31, 2024, we were not aware of any cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition. As discussed more fully under Part 1, Item 1A. Risk Factors, the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See Part 1,


text: Item 1A. Risk Factors entitled "Risks Related to Intellectual Property, Information Technology and Data Privacy" included elsewhere in this Annual Report on Form 10-K.


text: We have established a corporate governance structure that provides oversight and guidance for our cybersecurity and data privacy program. Our Board of Directors (the "Board") is responsible for the oversight of our cybersecurity and privacy program and risks from cybersecurity threats. Our Board's Audit Committee, which supports the Board in its oversight of our cybersecurity and data privacy program, is focused on cybersecurity and data privacy risk, including incident response planning, and timely identification and assessment of cybersecurity threats, cybersecurity incident recovery and business continuity considerations.


text: We have defined roles and responsibilities for our assessment and management of risks related to cybersecurity threats, including specific executive-level and management-level positions or committees. Our cybersecurity and privacy program is overseen by our Security and Privacy Program Office ("SPPO"), which is composed of corporate leadership from legal and information technology ("IT"). The SPPO reports to our Head of Information Technology, who is the accountable executive for our cybersecurity program. Our function and business unit executive leadership, acting in support of our SPPO, is responsible for ensuring organizational compliance with data protection safeguard regulations and related risk controls across our organization. Our Head of Information Technology and our Director, Compliance Standards & Data Privacy ("DCSDP"), are responsible for the design, implementation, and monitoring of the cybersecurity and data privacy policies, standards, procedures, and controls that govern our information systems and data processing activities. Our Head of Information Technology has more than 30 years of experience in IT infrastructure, cybersecurity operations, and site reliability engineering for a wide range of software and service organizations, with the last 16 years focused on SaaS software businesses with access to sensitive customer data. The DCSDP also has over 30 years in IT with the last 13 focused on compliance and data privacy issues for Certara.


text: Our Head of Information Technology and DCSDP report to our General Counsel, as well as to our Board through its Audit Committee. The IT Security team and DCSDP coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the SPPO, the Board and the Audit Committee on a quarterly basis, or more frequently as needed.


text: We have established processes to ensure that management is informed about and monitors cybersecurity threat prevention, detection, mitigation, and, if necessary, cybersecurity incident remediation. These processes include regular reporting, escalation, and communication protocols, as well as periodic reviews and audits of our cybersecurity and data privacy program.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Playtika Holding Corp.

ticker: PLTK


text: We use the NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program comprises one component of our overall enterprise risk management program which is organized by discipline areas. Our cybersecurity risk management program shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • integration with software development procedures and processes throughout the lifecycles of our products. • a team comprised of IT security, IT engineering and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems and designated security champions throughout the Company's departments; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; • a third-party risk management process for service providers.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems, product and network. See "Risk Factors – Our success depends on the security and integrity of the games we offer, and security breaches or other disruptions could compromise our information or the information of our players and expose us to liability, which would cause our business and reputation to suffer."


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences."


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.


text: Our Chief Information Security Officer periodically reports to the Board and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CISO on our cybersecurity risks, including briefings on our cyber risk management program and any cybersecurity incidents. Board members also receive periodic presentations on cybersecurity topics from our CISO or our Chief Technology Officer.


text: Our CISO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: Our CISO is responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant experience in managing and leading IT and cybersecurity teams. Prior to joining the Company, he served as the chief technology officer and cofounder of a company specializing in cybersecurity services and software. Our CISO reports directly to our CTO who has over twenty years of experience in technology and IT including roles at large global companies.


text: During the reporting period, we did not experience any cybersecurity incident that has materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences."


text: Cybersecurity risk management is a key component of our overarching risk management strategy. Given the susceptibility of our industry to cyber threats and attacks, we regularly encounter attempted attacks of varying types. Both the financial and personal data in our systems, coupled with the dynamic nature of our products and services, make us a potential target. We operate internationally with employees, contractors, vendors, developers, partners, and third parties, which complicates our risk exposures.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: Our information security program encompasses policies and controls aimed at mitigating cybersecurity risks. However, we acknowledge the presence of both known and unknown risks, alongside vulnerabilities within our security program. Continuous improvement efforts are integral to enhancing our information security program and overall risk management endeavors.


text: We employ a risk management framework aligned with relevant laws, regulations, and industry standards to manage cybersecurity risks across our products and services, infrastructure, and organization. Our internal risk assessment processes incorporate various factors, including tracking threat intelligence and identified first- and third-party vulnerabilities, evaluating evolving regulatory requirements, and analyzing internally observed cybersecurity threats and incidents. We regularly conduct an internal risk assessment to evaluate the effectiveness of the security of our systems and of our processes, identify areas for remediation, and explore opportunities for enhancement, such as cloud and endpoint security enhancements, application programming interface (API) security, and contractor access management. We utilize third-party security experts and consultants on an annual basis to assess and improve our cybersecurity risk management tools and processes and to benchmark against industry standards.


text: Additionally, we maintain a privacy risk management program to evaluate risks associated with the collection, usage, sharing, and storage of customer data. An independent third-party assesses our privacy risk management program, to evaluate efficacy and to benchmark against industry standards.


text: On an annual basis we obtain an independent assessment and evaluation of the operation of our cybersecurity and privacy programs, as well as the supporting control frameworks. The findings of these independent assessments facilitate our risk-based decision-making, prioritization of cybersecurity countermeasures, and risk mitigation strategies. Our risk mitigation strategies encompass an array of technical and operational measures, complemented by annual cybersecurity and privacy training for all employees.


text: Additionally, we have specific policies and practices governing third-party security risks, including our third-party risk management (TPRM) program. Under this program, we gather information from relevant third parties to assess potential risks associated with their security controls.


text: Our board of directors oversees our strategic and business risk management, with cybersecurity risk management oversight delegated to the Audit, Risk, and Compliance Committee (the "Committee"). The Committee also oversees risks related to privacy and data use and monitors our compliance with our privacy program. Management is responsible for the ongoing identification, assessment, and management of material cybersecurity risks, along with the implementation of processes for monitoring potential cybersecurity risk exposures, deploying appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to the Committee and to the board of directors.


text: Tal Hornstein, our Chief Information Security Officer (CISO), leads our cybersecurity program and oversees teams supporting security functions across the company. Mr. Hornstein holds a CISSP certification from ISC2 and has over 20 years of experience in multiple cybersecurity and technology-related roles. He joined Hippo in late 2021 and has been instrumental in designing and executing our entire cybersecurity stack.


text: Our cybersecurity team monitors prevention, detection, mitigation, and remediation of cybersecurity incidents through technical and operational measures, regularly reporting to the CISO. As a key member of the senior management team, the CISO provides updates to the Committee on the company's cybersecurity program, including risks, incidents, and mitigation strategies.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report, we have not identified any cybersecurity threats materially affecting, or reasonably likely to materially affect, our business strategy, results of operations, or financial situation. However, despite our efforts, we recognize the impossibility of eliminating all cybersecurity risks or guaranteeing the absence of undetected cybersecurity incidents. For additional information about these risks, refer to Part I, Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Our information security program encompasses policies and controls aimed at mitigating cybersecurity risks, including an incident response plan that includes procedures for assessing and responding to cybersecurity incidents. However, we acknowledge the presence of both known and unknown risks, alongside vulnerabilities within our security program. Continuous improvement efforts are integral to enhancing our information security program and overall risk management endeavors.


text: We employ a risk management framework aligned with relevant laws, regulations, and industry standards to manage cybersecurity risks across our products and services, infrastructure, and organization. Our internal risk assessment processes incorporate various factors, including tracking threat intelligence and identified first- and third-party vulnerabilities, evaluating evolving regulatory requirements, and analyzing internally observed cybersecurity threats and incidents. We regularly conduct an internal risk assessment to evaluate the effectiveness of the security of our systems and of our processes, identify areas for remediation, and explore opportunities for enhancement, such as cloud and endpoint security enhancements, application programming interface ("API") security, and contractor access management. We utilize third-party security experts and consultants on an annual basis to assess and improve our cybersecurity risk management tools and processes and to benchmark against industry standards.


text: Additionally, we have specific policies and practices governing third-party security risks, including our third-party risk management ("TPRM") program. Under this program, we gather information from relevant third parties to assess potential risks associated with their security controls.


text: Tal Hornstein, our Chief Information Officer and Chief Information Security Officer ("CISO"), leads our cybersecurity program and oversees teams supporting security functions across the company. Mr. Hornstein holds a CISSP certification from ISC2 and has over 20 years of experience in multiple cybersecurity and technology-related roles. He joined Hippo in late 2021 and has been instrumental in designing and executing our entire cybersecurity stack.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report, we have not identified any cybersecurity threats materially affecting, or reasonably likely to materially affect, our business strategy, results of operations, or financial situation. However, despite our efforts, we recognize the impossibility of eliminating all cybersecurity risks or guaranteeing the absence of undetected cybersecurity incidents that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information about these risks, refer to Part I, Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Risk Management and Strategy Aurora's Information Security team has implemented a robust cybersecurity risk management program in order to protect the confidentiality, integrity, and availability of the Company's products, infrastructure, and data. The program, which is integrated with our overall risk management system, aims to identify, assess, and mitigate cybersecurity risks for both the product and the organization. It includes a cybersecurity incident response procedure ("CIRP") that defines roles and responsibilities during cybersecurity incidents, outlines incident handling procedures, including detection, investigation, and mitigation of incidents, and provides a framework for assessing incidents. Aurora's CIRP contributes to satisfaction of certain elements of Aurora's Safety Case. Additionally, the CIRP is referenced in and integrated into the Company's Cross-Functional Incident Response Plan, which serves as an outline of the actions to be taken across the Company immediately following a vehicle incident.

companyName: Aurora Innovation, Inc.

ticker: AUR


text: Aurora's Information Security team reports to and is led by our Vice President of Security Engineering, who is responsible for structuring and driving all cybersecurity initiatives at Aurora. This individual regularly reports cybersecurity progress to our Board of Directors, as well as senior leadership across the Company.


text: The Information Security team proactively reports, on a company-wide basis, the status of cybersecurity initiatives and risks, along with various assessments of our information security programs and the emerging threat landscape. We also perform periodic assessments and audits internally and also leverage third party experts, and the results of such assessments and audits are reported directly to senior leadership. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards and regularly monitor the effectiveness of our safeguards. We also actively engage with key partners, vendors, customers, industry participants, government entities, intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures, especially around self-driving / autonomous vehicles. We work to identify, assess, and oversee risks from cybersecurity threats associated with third-party service providers, including, where appropriate, by contractually requiring third-party service providers to promptly inform us of incidents impacting their systems that could result in access to, loss, or unavailability of Aurora's data. In addition, prior to engagement, we conduct thorough security assessments of all third-party service providers that handle confidential Aurora information or connect to Aurora computing environments. Such assessments include analysis of the service providers' data handling practices and the security of their integrations with Aurora's systems. This approach is designed to mitigate risks related to cybersecurity threats originating from third-parties.


text: Risks from Threats and Incidents We are subject to risks from cybersecurity threats and incidents to our vehicles and cloud infrastructure, including operational systems, security systems, integrated software and partners' data processed by us or third-party vendors or suppliers. However, as of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Our Business Operations."


text: Our information security management team, including our Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats. Our Interim Chief Information Security Officer, who also serves as Vice President of Security Engineering has more than ten years of experience as a network and security engineer and more than seven years of experience leading information security teams at renowned technology companies.


text: Members of our security operations team are responsible for notifying the information security management team about cybersecurity incidents. The information security management team is responsible for assessing cybersecurity incidents; managing the analysis, mitigation, and remediation of incidents; and conferring with other members of management about incidents, including the Chief Information Security Officer and other members of our senior executive management team.


text: Our Audit Committee, composed of members of our Board of Directors, oversees risks from cybersecurity threats and our cybersecurity risk management program as an integrated part of our overall risk management processes. We conduct quarterly assessments to identify and evaluate cybersecurity threats and present our findings to the Audit Committee. In consultation with the Disclosure Committee, we also notify the Audit Committee about cybersecurity incidents and risks related to cybersecurity incidents. The Audit Committee is responsible for advising the Company on appropriate incident response steps.


text: Aurora's Information Security team reports to and is led by our Vice President, Head of Security Engineering, who is responsible for structuring and driving all cybersecurity initiatives at Aurora. This individual regularly reports cybersecurity progress to our Board of Directors, as well as senior leadership across the Company.


text: Risks from Threats and Incidents We are subject to risks from cybersecurity threats and incidents to our vehicles and cloud infrastructure, including operational systems, security systems, integrated software and partners' data processed by us or third-party vendors or suppliers. However, as of December 31, 2024, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Our Business Operations."


text: Our information security management team is responsible for assessing and managing material risks from cybersecurity threats. Our Vice President, Head of Security Engineering has more than thirty-five plus years of experience as a security expert and more than twenty-five plus years of experience leading information security teams at renowned technology companies.


text: In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, financial information, trade secrets, intellectual property, information regarding trial participants in connection with clinical trials, sensitive third-party information and employee information. In an effort to protect this information from cybersecurity risks, we have developed a cybersecurity program which incorporates policies and practices designed to protect the confidentiality, integrity and security of our sensitive information.

companyName: Barinthus Biotherapeutics plc.

ticker: BRNS


text: As part of our cybersecurity risk management procedures, we perform system monitoring and scanning and utilize security tools supported by a third-party managed services provider. We also conduct penetration testing performed by a third-party provider. Employees are enrolled in cybersecurity awareness training courses designed to help them identify cybersecurity concerns and take appropriate actions, and we conduct periodic simulated phishing tests in an effort to further raise cybersecurity awareness and reduce the risk of a successful cyberattack. We have established an incident response plan to guide us in responding to cybersecurity incidents. We also take steps to protect against business interruption and conduct annual restoration testing for major systems. In addition, we are developing a cybersecurity risk management program for our third-party vendors. This program aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity practices.


text: Our cybersecurity program is managed by our IT Director, who reports directly to senior management on matters regarding cybersecurity, as appropriate. Our IT Director has over twenty years of experience in IT, including cybersecurity, and previously served as the IT Director at another biopharmaceutical company. Together, our senior management and IT Director are responsible for leading company-wide cybersecurity strategy, policies, standards, and processes.


text: The Audit Committee, pursuant to its charter, has oversight over management of cybersecurity risks. Senior management and our IT Director provide the Audit Committee with periodic updates on data management and cybersecurity initiatives, as well as on significant existing and emerging cybersecurity risks, including cybersecurity incidents, as applicable.


text: We have a process to record identified risks from cybersecurity threats in our risk register, along with an assessment of the severity of the potential impact and the likelihood of occurrence. This process is designed to facilitate a unified and integrated assessment of corporate risk and governance. The risk register is reviewed periodically by senior management and at least annually by the Board of Directors. Our cybersecurity program is also periodically evaluated by external security consultants, with the results of those reviews reported to senior management and the Audit Committee, as appropriate.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors may experience threats and security incidents that could affect our information or systems. For more information about the cybersecurity risks we face, please see Section 1A. Risk Factors.


text: As part of our cybersecurity risk management procedures, we perform system monitoring and scanning and utilize security tools supported by a third-party managed services provider. We also conduct penetration testing performed by a third-party provider. Employees are enrolled in cybersecurity awareness training courses designed to help them identify cybersecurity concerns and take appropriate actions, and we conduct periodic simulated phishing tests in an effort to further raise cybersecurity awareness and reduce the risk of a successful cyberattack. We have an incident response plan to guide us in responding to cybersecurity incidents, and have conducted tabletop exercises to test the plan. We also take steps to protect against business interruption and conduct annual restoration testing for major systems. In addition, we use a risk-based approach to assessing cybersecurity risks from certain critical third-party vendors. This program aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity practices.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and manufacturing-related information ("Information Systems and Data").

companyName: Enovix Corp

ticker: ENVX


text: Our board, through our Nominating and Governance committee and our Information Security committee, together with company executives, IT and security management teams in conjunction with third party service providers who specialize in cybersecurity help identify, assess and manage the Company's cybersecurity threats and risks. We have a quarterly review of cybersecurity by our Nominating and Governance committee and our Information Security committee. We use a number of processes to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example via manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting routine scans of the threat environments, evaluating our and our industry's risk profile, performing annual assessments and penetration testing, evaluating the threats reported to us, coordinating with law enforcement concerning threats, conducting internal and external audits, conducting threat assessments for internal and external threats, reviewing third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, using of external intelligence feeds, conducting third-party- red/blue team testing and tabletop incident response exercises. In addition, we conduct internal tabletop exercise, third party red-team pen testing and OT security monitoring.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example incident response plans, incident detection and response policies and procedures, vulnerability management policy, disaster recovery plans, and encryption of data.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, we have (1) cybersecurity risk addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) the security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our information security committee evaluates material risks from cybersecurity threats against our overall business objectives and our CISO reports to the Nominating and Governance committee the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetrating testing firms, dark web monitoring services, forensic investigators and DHS CISA monitoring service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessment for each vendor, security questionnaires, review of the vendor's written security program, review of security assessments, reports, vulnerability scans related to vendors, imposition of information contractual obligations on the vendors and other elements of vendor management program such as continuous cyber security monitoring by third-party service. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our batteries and our website, systems and data we maintain may be subject to intentional disruption, other security incidents or alleged violations of laws, regulations or other obligations relating to data handling that could result in liability and adversely impact our reputation and future sales."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Nominating and Governance committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our Nominating and Governance committee consist of members with years of experience in cybersecurity oversight.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Information Security Steering Committee which meets quarterly to review cybersecurity matters. Our Information Security Steering Committee is comprised of our Chief Information Security Officer, our CEO, CFO, COO, Chief Legal Officer, Vice President of Human Resources and Vice President of Information Technology. At the management level, our CISO, who reports to our Chief Information Officer, is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cyber security with over 25 years of experience in leading security teams, developing security strategies, and managing risk across various industries. Our CISO has operated in this capacity at three other public companies and our CIO has over 25 years of information technology experience and managing cybersecurity risk including at other public companies.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. They work in conjunction with our Nominating and Governance Committee Chair and member. Our CISO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CISO and our Nominating and Governance Committee Chair and member. These officials work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the Nominating and Governance Committee of the board of directors for certain cybersecurity incidents.


text: The Nominating and Governance Committee receives periodic reports from our CISO Information Security concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Nominating and Governance Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and manufacturing-related information ("Information Systems and Data").


text: Our board, through our Nominating and Governance committee, together with our company executives through our Information Security committee, and our IT and security management teams in conjunction with third party service providers who specialize in cybersecurity, help identify, assess and manage the Company's cybersecurity threats and risks. We have a quarterly review of cybersecurity by our Nominating and Governance committee and our internal Information Security committee. We use a number of processes to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example via manual and automated tools, which are internally prepared and also through external third-party vendors, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting routine scans of the threat environments, evaluating our and our industry's risk profile, performing annual assessments and penetration testing, evaluating the threats reported to us, coordinating with law enforcement concerning threats, conducting internal and external audits, conducting threat assessments for internal and external threats, reviewing third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, using of external intelligence feeds, conducting third-party- red/blue team testing and tabletop incident response exercises. In addition, we conduct internal tabletop exercise, third party red-team pen testing and OT security monitoring.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Nominating and Governance committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our Nominating and Governance committee consists of members with years of experience in cybersecurity oversight.


text: Our cybersecurity risk assessment and management processes are maintained by certain Company management, including the members of our Information Security Steering Committee, which meets quarterly to review cybersecurity matters. Our Information Security Steering Committee is comprised of our Chief Information Security Officer ("CISO"), CEO, Chief Financial Officer, Chief Accounting Officer, COO, Chief Legal Officer, Vice President of Human Resources and Vice President of Global Information Technology. At the management level, our CISO, who reports to our Chief Information Officer ("CIO"), is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cybersecurity with years of experience in leading security teams, developing security strategies, and managing risk across various industries. Our Vice President, Global Information Technology serves as our CIO, and has over 25 years of information technology and cybersecurity risk management experience, including at other public companies.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant stakeholders at our US headquarters, and each of our international subsidiary locations. Our CISO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. The CISO works in conjunction with our Nominating and Governance Committee Chair and committee members.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CISO and our Nominating and Governance Committee Chair and members. These officials work with the Company's incident response team to help the Company mitigate and remediate any cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the Nominating and Governance Committee of the board of directors for certain cybersecurity incidents.