text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external advisors and service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, contractors, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and alignment with the broader corporate business continuity plan; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."

companyName: Verona Pharma plc

ticker: VRNA

secItem: Item 1C


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Vice President, Digital and Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Vice President, Digital and Information Technology and Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes decades of managing public pharmaceutical companies, including their related information technology and cybersecurity risk management programs.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program includes: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external advisors and service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees and contractors, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and alignment with the broader corporate business continuity plan; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Audit Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.

companyName: HERTZ GLOBAL HOLDINGS, INC

ticker: HTZ


text: Tim Langley-Hawthorne is our CIO and has served in this role since October 2021. Mr. Langley-Hawthorne has 11 years of experience in senior technology roles with cybersecurity responsibilities. Prior to joining the Company, Mr. Langley-Hawthorne served as the Chief Information Officer at Hitachi Vantara, a hi-tech subsidiary of Hitachi Ltd. Prior to Hitachi, Mr. Langley-Hawthorne held various executive technology and operations positions at Western Union, as well as various IT, consulting and commercial roles at Information Services Group, Electronic Data Systems, and IBM Australia. Mr. Langley-Hawthorne holds an Executive MBA from Pepperdine University and a Bachelor of Commerce degree from the University of Melbourne, Australia.


text: We are currently completing the search for a new CISO, following the voluntary departure of the incumbent CISO. An accomplished information technology leader with 29 years of experience in the field and 20 months of experience with the Company is currently serving in the role on an interim basis.


text: operations or financial condition in the future. See "Risks Related to Information Technology, Cybersecurity and Privacy" in Item 1A, "Risk Factors" of this 2024 Annual Report.


text: Our Board oversees significant risks facing the Company. For some categories of risk, the Board has empowered a committee to provide more focused oversight. In the case of cybersecurity and technology risk more broadly, the Board's Audit Committee has that responsibility.


text: The Audit Committee is informed of risks from cybersecurity threats through regular reports from management and, from time to time, third parties that assist management in managing cybersecurity threats. The Audit Committee also receives regular reports on how management identifies, assesses and manages cybersecurity and broader technology risks. The Audit Committee reviews these reports and discusses them with management.


text: The Audit Committee provides a regular report to the full Board on key aspects of management's presentations on cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Audit Committee. Audit Committee conversations on cybersecurity topics are open to any member of the Board.


text: While our Board and Audit Committee oversee risk, our senior leadership is responsible for identifying, assessing and managing our exposure to risk, including material risks from cybersecurity threats. Direct accountability of our cybersecurity program is housed within our Information Technology organization, which is led by our Chief Information Officer ("CIO"). Our CIO has served in this role since October 2021. Our CIO has 12 years of experience in senior technology roles with cybersecurity responsibilities. Prior to joining the Company, our CIO held various executive technology and operations positions, as well as various IT, consulting and commercial roles. Our CIO holds an Executive MBA and a Bachelor of Commerce degree.


text: Our Chief Information Security Officer ("CISO") is the individual that reports to our CIO and provides day-to-day oversight of our cybersecurity program; our CISO additionally leads our cybersecurity program's ongoing evolution. Our CISO is responsible for assessing and managing risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our CISO oversees direct reports and leverages a multi-disciplinary team that regularly communicates with respect to our prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The team consists of individuals that represent various organizations and departments across the Company who have knowledge, skills and expertise to respond to a cybersecurity incident. Our CISO coordinates with the Company's disclosure teams relating to potentially material cybersecurity incidents, attends the Company's disclosure committee meetings, and regularly discusses with the Audit Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks. Our CISO has served in this role since March 2024. Our CISO has over 11 years of experience in senior technology roles with cybersecurity responsibilities, and more than 20 years of experience in technology and security. Our CISO holds an MBA; in addition, he holds a Bachelor of Computer Science degree and a Bachelor of Mathematics degree.


text: We rely on information technology and data to operate our business effectively and recognize the importance of implementing and maintaining cybersecurity systems and processes that allow us to protect the confidentiality, integrity and availability of our information systems and the data residing within them.

companyName: Permian Resources Corp

ticker: PR


text: In order to monitor our information technology systems and data and to identify potential threats to such, we maintain cybersecurity risk assessment and management programs. Such programs include, but are not limited to, annual security penetration tests performed both externally and internally, bi-annual security assessments against cybersecurity frameworks, continuous vulnerability scanning, incident response processes, monthly and annual security awareness and simulated phishing trainings for our employees, and various system alert monitoring and screenings.


text: As part of our cybersecurity risk management process, we conduct simulated cybersecurity incidents to ensure that we are prepared to respond to such incidents and to highlight any areas for potential improvement in our cyber incident preparedness. We have a cybersecurity incident management policy and response plan in place. Cybersecurity breaches are evaluated by our information technology teams, which includes our VP of Information Technology. If an incident is deemed to be a breach, it is communicated to our legal department and management for evaluation, including whether the breach requires communication to the Board of Directors or investors through a relevant public filing.


text: Our cybersecurity risk management is primarily the responsibility of our VP of Information Technology and information technology teams. Our VP of Information Technology has over 25 years of industry experience in the field of information systems and oversees our risk assessment programs, remediation of known risks, processes for the regular monitoring of our information systems and our employee cybersecurity training programs. Our Board of Directors also oversees cybersecurity risk through our Audit Committee who reviews periodic reporting and updates regarding our risk management associated with cybersecurity.


text: We have not experienced any cybersecurity incidents that have had a material impact on our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, refer to Risk Factors under Part I, Item 1A of this Annual Report.


text: In order to monitor our information technology systems and data and to identify, assess and manage potential threats to such, we maintain cybersecurity risk assessment and management programs. As part of such programs, we endeavor to conduct annual security penetration tests both externally and internally, bi-annual security assessments against cybersecurity frameworks, continuous vulnerability scanning and monthly and annual security awareness and simulated phishing trainings for our employees. We have also implemented incident response processes and various system alert monitoring and screenings. Our cybersecurity risk management processes are integrated into our broader risk management program.


text: As part of our cybersecurity risk management process, we conduct simulated cybersecurity incidents to ensure that we are prepared to respond to such incidents and to highlight any areas for potential improvement in our cyber incident preparedness. We have a cybersecurity incident management policy and response plan in place. Cybersecurity breaches are evaluated by our information technology teams, which includes our Vice President and Chief Information Officer. If an incident is deemed to be a breach, it is communicated to our legal department and management for evaluation, including whether the breach requires communication to the Audit Committee or the Board of Directors or investors through a relevant public filing.


text: Our cybersecurity risk management is primarily the responsibility of our Vice President and Chief Information Officer and the information technology teams he leads. Our Vice President and Chief Information Officer has 25 years of industry experience in the field of information systems, including information security and risk management. He oversees our risk assessment programs, remediation of known risks, processes for the regular monitoring of our information systems and our employee cybersecurity training programs. Our Board of Directors also oversees cybersecurity risks through the Audit Committee, which receives and assesses periodic reports and updates regarding our cybersecurity risk management from management and our Vice President and Chief Information Officer and then relays them to the Board of Directors as needed.


text: Impact of Risks from Cybersecurity Threats As of the date of this report, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations and financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents, material or otherwise, remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity incident will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. For more information about the cybersecurity risks we face, refer to Risk Factors under Part I, Item 1A of this Annual Report.


text: Our process for assessing, identifying, and managing material risks associated with cybersecurity threats, including risks related to disruptions to our operations, compromise of our intellectual property rights, data privacy, litigation and other legal liability and reputational impacts, is an important component of our overall enterprise risk management process. As part of this process, both corporate and operating company leaders collaborate with subject matter experts to identify and assess cybersecurity threats and implement relevant countermeasures. In addition to this component of our overall risk management process, we have separate cybersecurity-specific risk assessment and management processes that are managed centrally and executed at both the corporate and operating company levels. These processes, including corresponding controls, are designed to help us protect against, detect, and respond to cybersecurity threats, and to manage business continuity, the availability of critical systems, product security, disclosure controls and procedures, escalation, and regulatory compliance in the event of any cybersecurity disruption.

companyName: Fortive Corp

ticker: FTV


text: As part of our cybersecurity controls and processes: • we have designed our cybersecurity program based on the National Institute of Security and Technology ("NIST") framework, Generally Accepted Privacy Program ("GAPP") guiding principles, and ISO 27001/2 standards; • our cybersecurity team, led by our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") coordinates with our privacy and information governance team within our legal department to help ensure compliance with applicable regulatory and reporting requirements; • the CIO and CISO undertake an annual review of the cybersecurity strategy and initiatives for Fortive and each of the operating companies, with monthly reviews of performance relative to strategic initiatives with the Chief Executive Officer ("CEO") and the other executive officers; • the CIO and CISO participate in product design efforts with operating company leaders to enhance our product security; • through the compliance training program, we conduct mandatory cybersecurity management, data privacy and incident training for all employees; • we conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to possible threats; • through policy, practice and contract provisions, we require employees, as well as third-party vendors who process data, to treat customer and other personal information and data with care and in compliance with regulations; • we run tabletop exercises conducted by leading third-party cybersecurity experts, with involvement by the broader IT team, legal team, communications team, executive management team, and the Board, to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • we conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing designed to improve our information systems; • we review and update, and provide training, on cybersecurity incident response plans, business continuity plans, and cyber incident escalation plans, including the involvement of our Disclosure Committee (which includes our CISO as a regular member); • as part of that cyber incident escalation plan, our Disclosure Committee reviews cybersecurity incidents to assess materiality and consider disclosure requirements; • the CISO meets with the information security teams at the operating companies on a monthly basis, or as needed, to review escalated items, compliance with incident response plans, and performance against strategic targets; • the CIO and the CISO meet with the CEOs of our operating segments and the presidents of our operating companies to discuss IT strategies, updates, and initiatives, including those related to cybersecurity; • the CIO and the CISO meet with the Audit Committee on a quarterly basis and the full Board on an annual basis to provide updates on the cybersecurity program, including controls and processes, strategies, achievements, risks, and recent incidents;


text: • the CIO and the CISO also meet with the full Board on an annual basis as part of the overall enterprise risk management review; and • the CISO, as a member of the Disclosure Committee, meets with other members of the Disclosure Committee to discuss materiality and disclosure with respect to cybersecurity matters.


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having independent cybersecurity experts conduct tabletop exercises, conduct penetration tests, and review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: In addition, our processes also address cybersecurity threat risks associated with our use of third-party software and service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on critical third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties to agree by contract to manage their cybersecurity risks in specified ways to be subject to cybersecurity audits, which we may conduct as appropriate.


text: To date, we believe that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to the discussions under the headings "Significant disruptions in, or breaches in security of, our information technology systems have adversely affected, and in the future could adversely affect, our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, and "Overview-Other Matters" included as part of our Management's Discussion and Analysis of Financial Condition and Results of Operations ("MD&A") at Item 7 of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and provides regular reports to the entire Board. In addition, at least annually, the entire Board receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Board generally receives materials indicating current and emerging material cybersecurity threat risks and describing the company's ability to mitigate those risks, and discusses such matters with our CIO and CISO. Material cybersecurity threat risks are also considered during separate Board meeting discussions of overall key enterprise risks, operational budgeting, crisis management planning, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CIO and our CISO. Our CIO and our CISO have over 30 years and 25 years, respectively, of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and implementing business continuity planning and incident response plans. Our CIO and CISO each hold several degrees and certifications relevant to their roles. Our CIO and our CISO are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, oversight of the entire IT function, including at Fortive Corporation and the IT leaders at our operating companies.


text: Our CIO and our CISO report to the Audit Committee and to the full Board about cybersecurity threat risks and other cybersecurity related matters. In addition, under our escalation policy, following the detection of a potentially significant cybersecurity incident, our CISO and our General Counsel escalate to the Executive Officers, core members of the Disclosure Committee, Chair of the Audit Committee and the Chair of the Board initially, and then to the entire Board, as appropriate.


text: To date, we believe that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to the discussions under the headings "Significant disruptions in, or breaches in security of, our information technology systems have adversely affected, and in the future could adversely affect, our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Okta, like other companies, is subject to a wide variety of cybersecurity attacks on its systems and networks on an ongoing basis and with increasing sophistication. In addition to threats from traditional computer "hackers," malicious code (such as malware, viruses, worms and ransomware), employee or contractor theft or misuse, password spraying, phishing and denial-of-service attacks, Okta and its third-party service providers now also face threats from sophisticated nation-state actors and organized crime groups who engage in attacks (including advanced persistent threat intrusions). In the face of this threat landscape, Okta remains committed to protecting its systems, internal networks and its customers' systems, and the information that it and they store and process.

companyName: Okta, Inc.

ticker: OKTA


text: Okta has an established cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems, internal networks and information. This program implements policies, processes and controls to respond to cybersecurity threats and mitigate business impacts. Okta's board of directors (the "board") has delegated to the cybersecurity risk committee of the board (the "cybersecurity risk committee") oversight responsibility of the cybersecurity risk management program, which includes a cybersecurity incident response plan.


text: Okta devotes significant resources, including human and financial capital, to create security measures, configuration policies and response plans to address cybersecurity threats. However, as a well-known provider of identity and security solutions, Okta is a particularly attractive target for such threats. For additional information related to these risks, see " Risk Factors " included under Part I, Item 1A of this Annual Report on Form 10-K. In the past we have experienced cybersecurity incidents, and we cannot anticipate when or the extent to which cybersecurity breaches will materially affect Okta or its customers' use of Okta's platform in the future. To date we have not identified any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that Okta's cybersecurity risk management program and processes, including its policies, controls or procedures, will be fully implemented, complied with or effective in protecting its systems and information.


text: Cybersecurity is essential for Okta. Our cybersecurity strategy is to develop a consistent framework of security controls that can apply to all business functions. To execute on this strategy, we integrate cybersecurity risk management into our broader enterprise risk management program. We also take a cross-functional approach to cybersecurity risk management by engaging teams across the business, including security, technical operations, engineering, IT, customer support, legal and communications, to implement shared processes for identifying, assessing and managing key cybersecurity risks.


text: We design and assess our cybersecurity risk management program against the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework"). This does not imply that Okta satisfies any particular specifications or requirements, only that we use the NIST Framework to guide our efforts to improve our security posture.


text: Our cybersecurity risk management program consists of technical and organizational safeguards aimed at protecting the confidentiality of our systems and the Okta platform. From time to time, we engage external consultants and advisors to perform independent assessments and testing of our program, or otherwise assist with aspects of our program and security controls.


text: Key features of our cybersecurity risk management program include: • Designated security risk team. Our security risk management team is responsible for maintaining Okta's cybersecurity risk management framework and risk assessments and tracking risk mitigation efforts. This team, together with our enterprise risk management team, monitors and regularly reports on our cybersecurity risk profile. Our internal audit team partners with these teams to provide input on the overall effectiveness of Okta's security risk governance and management processes. • Risk assessments. We periodically perform enterprise-wide assessments to stay informed about critical security risks. Okta's functional teams also assess risks associated with their specific activities, with supervision by the security risk management team. Functional team risk assessments follow an established framework that includes information-gathering from internal and external sources to identify risks, and evaluating the adequacy of controls to mitigate those risks. We have a management-level risk oversight committee, led by internal audit and security risk management personnel, that meets quarterly with other internal business leaders to review the results of these enterprise-wide and functional team risk assessments and evaluate the adequacy of any proposed mitigation plans. • Incident response planning. Okta's cybersecurity incident response plan outlines the processes and procedures for responding to, remediating and resolving a security incident, and defines the roles and responsibilities of Okta personnel in responding to such incidents. • Security awareness training. We require our employees and contractors to complete general cybersecurity awareness training at least annually. These training sessions advise on how to protect Okta, our information systems and data, as well as our customers' systems and data. From time to time we may also require supplemental cybersecurity training for certain members of our workforce depending on their job responsibilities. • Third-party risk management. We require high risk third-party vendors, suppliers and service providers to undergo a cybersecurity risk assessment prior to contracting with Okta. Certain third parties are monitored and reassessed on an ongoing basis, depending on their level of risk or in the event of changes to their products or services.


text: Okta's board oversees Okta's enterprise risk management program, of which cybersecurity is a critical component. To facilitate the board's supervision of cybersecurity matters, the board formed a cybersecurity risk committee. Among other responsibilities, the cybersecurity risk committee oversees Okta's cybersecurity program.


text: The cybersecurity risk committee receives regular updates from Okta's chief security officer (the "CSO") on our cybersecurity program. In addition, management updates the cybersecurity risk committee, as appropriate, regarding cybersecurity incidents. The cybersecurity risk committee reports to the board on its activities. In addition to receiving reports from the cybersecurity risk committee, the board periodically receives cyber risk management program briefings directly from the CSO. Additionally, the audit committee of the board receives cybersecurity updates as part of the audit committee's oversight of Okta's enterprise risk management program.


text: Our management team, including the CSO, is responsible for assessing and managing our risks from cybersecurity threats. The CSO partners with the security, technical operations, legal, internal audit, engineering and product development teams to supervise both our cybersecurity program and our retained external cybersecurity consultants, and to stay informed on Okta's security and the overall security landscape. Our current CSO brings over 20 years of cybersecurity and risk management experience to his work at Okta, having held numerous security leadership positions in highly-regulated industries such as finance. Prior to joining Okta, the CSO was Senior Vice President and Chief Security Officer at Symantec Corporation, a leading cybersecurity company, where he had global oversight responsibility for all cybersecurity and physical security programs. His experience delivering cybersecurity at scale extends internationally, and includes security and risk management roles at companies in Australia, the United Kingdom and the United States. Our security team includes individuals with experience across a broad range of cybersecurity areas, including product security; cloud security; infrastructure security; security monitoring and incident response; identity and access management; vulnerability management; and governance, risk and compliance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security and technical personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our technical environment.


text: Cybersecurity risk management is an important part of our overall risk management efforts. Okta, Inc., like other companies, is subject to a wide variety of cybersecurity attacks on its systems, networks and data on an ongoing basis and with increasing sophistication. Given the evolving cybersecurity threat landscape facing us and our third-party service providers, we remain committed to protecting our systems, internal networks and our customers' systems, and the information that we and they store and process.


text: We have an established cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of Okta, Inc.'s critical systems, internal networks, and information. This program implements policies, processes and controls to respond to cybersecurity threats and mitigate business impacts. Our board of directors (the "board") has delegated to the cybersecurity risk committee of the board (the "cybersecurity risk committee") oversight responsibility of the cybersecurity risk management program, which includes a cybersecurity incident response plan.


text: We devote significant resources, including human and financial capital, to create security measures, configuration policies and response plans to address cybersecurity threats. However, as a well-known provider of identity and security solutions, Okta, Inc. is a particularly attractive target to threat actors. For additional information related to these risks, see " Risk Factors " included under Part I, Item 1A of this Annual Report on Form 10-K. In the past we have experienced cybersecurity incidents, and cannot anticipate when or the extent to which cybersecurity incidents will materially affect us or our customers' use of our platforms in the future. To date we have not identified any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our efforts, we cannot eliminate all risks related to cybersecurity threats or incidents. There can be no assurance that Okta, Inc.'s cybersecurity risk management program and processes will be fully implemented. Even if implemented, they may not be complied with or may not effectively protect our systems and information or those of our customers.


text: Cybersecurity is a top priority for Okta, Inc. Our cybersecurity strategy is to develop a consistent framework of security controls that can apply to all business functions. To execute on this strategy, we integrate cybersecurity risk management into our broader enterprise risk management program. We also take a cross-functional approach to cybersecurity risk management by engaging teams across the business, including security, technical operations, engineering, IT, customer support, legal and communications, to implement shared processes for identifying, assessing, and managing key cybersecurity risks.


text: We design and assess our cybersecurity risk management program against the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework"). This does not imply that Okta, Inc.'s cybersecurity risk management program satisfies any particular specifications or requirements, only that we use the NIST Framework to guide our efforts to improve our security posture. Certain of our Okta Platform product offerings have attained multiple security certifications, the details of which are described in "Our Technology" under Part I, Item I of this Annual Report on Form 10-K.


text: Our cybersecurity risk management program consists of technical and organizational safeguards aimed at protecting the confidentiality of our systems and platforms. From time to time, management will engage external consultants and advisors to perform independent assessments and testing of the cybersecurity risk management program, or otherwise assist with aspects of the program and security controls.


text: Key features of our cybersecurity risk management program include: • Designated security governance, risk and compliance team. Our security governance, risk and compliance team is responsible for maintaining Okta, Inc.'s cybersecurity risk management framework and risk assessments, and for tracking risk mitigation efforts. This team, together with our enterprise risk management team, monitors and regularly reports on our cybersecurity risk profile. Our internal audit team partners with these teams to provide input on the overall effectiveness of Okta, Inc.'s security risk governance and management processes. • Risk assessments. We periodically perform security risk assessments to stay informed about relevant security risks. Functional teams across the business assess risks associated with their specific activities, following an established framework with supervision by the security governance, risk and compliance team. Okta, Inc. has a management-level risk oversight committee, led by internal audit and security risk management personnel, that meets quarterly with other internal business leaders to review the results of these security risk assessments and evaluate the adequacy of any proposed mitigation plans. • Incident response planning. Our cybersecurity incident response plan outlines the processes and procedures for responding to, remediating and resolving a security incident, and defines the roles and responsibilities of company personnel and third-party service providers who may assist in responding to such incidents. In fiscal 2025, we conducted tabletop exercises involving multiple operational teams, as well as an executive preparedness simulation with members of our management team, to educate personnel on their roles in response scenarios. • Security awareness training. We require our employees and contractors to complete general cybersecurity awareness training at least annually. These training sessions advise on employee responsibilities and relevant policies designed to protect us, our information systems and data, as well as our customers' systems and data. From time to time we may also require supplemental cybersecurity training for certain members of our workforce depending on their job responsibilities. • Third-party risk management. We require high risk third-party vendors, suppliers and service providers to undergo a cybersecurity risk assessment prior to contracting with Okta, Inc. Certain third parties are monitored and reassessed on an ongoing basis, depending on their level of risk or in the event of changes to their products or services.


text: Our board oversees Okta, Inc.'s enterprise risk management program, of which cybersecurity is an important component. To facilitate the board's supervision of cybersecurity matters, the board formed the cybersecurity risk committee. Among other responsibilities, the cybersecurity risk committee provides oversight over the effectiveness of Okta, Inc.'s cybersecurity program.


text: The cybersecurity risk committee receives regular updates on our cybersecurity program from our chief security officer (the "CSO"). In addition, management updates the cybersecurity risk committee, as appropriate, regarding cybersecurity incidents. Our cybersecurity risk committee reports to the board on its activities. In addition to receiving reports from the cybersecurity risk committee, our board periodically receives cyber risk management program briefings directly from the CSO. Additionally, the audit committee of the board (the "audit committee") receives regular cybersecurity updates as part of the audit committee's oversight over our enterprise risk management program.


text: Our management team, including the CSO, is responsible for assessing and managing our risks from cybersecurity threats. The CSO partners with the security, technical operations, legal, internal audit, engineering and product development teams to supervise both our cybersecurity program and our retained third-party cybersecurity consultants, and to stay informed on security at Okta, Inc. and the overall security landscape. Our current CSO brings over 20 years of cybersecurity and risk management experience to his work at Okta, Inc., having held numerous security leadership positions in highly-regulated industries such as finance. His experience delivering cybersecurity at scale extends internationally, and includes security and risk management roles at companies in Australia, the United Kingdom and the United States. The Okta, Inc. security team includes individuals with experience across a broad range of cybersecurity areas, including product security; cloud security; infrastructure security; security monitoring and incident response; identity and access management; vulnerability management; and governance, risk and compliance.


text: Okta, Inc.'s management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security and technical personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by us; and alerts and reports produced by security tools deployed in our technical environment.


text: Tenable recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and our exposure management solutions. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, our critical data (including without limitation intellectual property, confidential information that is proprietary, strategic or competitive, customer vulnerability data, and information systems data), and exposure management solutions.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: Our Information Security function is overseen by our Chief Security Officer, or CSO, and is supported by our Chief Information Officer, Product Engineering Team Lead, Chief Legal Officer, or CLO, and Head of Global Privacy. Our information security function is responsible for identifying, assessing and managing cybersecurity threats and risks and works to monitor and evaluate our threat environment and risk profile using various methods. These methods include conducting vulnerability assessments and threat assessments in certain environments for internal and external threats, scanning certain threat environments, analyzing certain reports of threats and actors, conducting internal audits for certain systems, evaluating our and our industry's risk profile, coordinating with law enforcement concerning select threats, and engaging with third-party service providers to conduct external audits, and threat assessments for certain systems, provide intelligence feeds, and conduct red/blue team testing and tabletop incident response exercises.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data depending on the environment. This includes maintaining an incident response plan, vulnerability management policy, and disaster recovery and business continuity plan, conducting risk assessments for certain environments, implementing security standards and certifications for certain products and systems, encrypting data in transit and at rest, controlling data access in certain environments, using multiple network controls in certain environments, segregating data, monitoring systems, performing regular security assessments for certain systems, training employees, maintaining cybersecurity insurance, maintaining dedicated cybersecurity staff, and conducting internal and external penetration tests.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. This integration is designed to ensure that cybersecurity considerations are part of our decision-making processes. Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Cybersecurity Risk Management Committee, or Cybersecurity Committee, of the Board of Directors, or Board.


text: We use third-party service providers to assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example cybersecurity consultants and software providers, managed cybersecurity service providers, threat intelligence service providers, forensic investigators, penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel and auditors. By partnering with these specialized providers, we can leverage their insights and expertise to implement cybersecurity strategies and processes that are designed to align with industry best practices.


text: Our collaboration with third parties includes cybersecurity audits, threat assessments, and consultation on security enhancements. We have established processes designed to manage the cybersecurity risks associated with working with third-party service providers. We evaluate the risks associated with third parties before engagement and maintain ongoing monitoring of such third parties designed to ensure compliance with our security standards. This includes security questionnaires and assessments, as well as external attack surface management. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: See Risk Factors in this Annual Report on Form 10-K for a description of the risks from cybersecurity threats that may materially affect us and how they may do so.


text: Our Board addresses cybersecurity risk management as part of its general oversight function. The Cybersecurity Committee is tasked with assisting the Board in fulfilling its oversight responsibility for our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: The Cybersecurity Committee bears the primary responsibility for oversight of the management of risks related to the Company's information technology use and protection, cybersecurity, and product security. The Cybersecurity Committee consists of directors with cybersecurity and other expertise including risk management, technology and finance. The Cybersecurity Committee assists the Audit Committee and the Board in overseeing Tenable's overall process of risk assessment and enterprise risk management.


text: Our CSO is responsible for implementing and maintaining our cybersecurity risk assessment and management processes. Our CSO has over 25 years of experience in cybersecurity, including serving as a chief security and strategy officer at another company and founding a cybersecurity operational technology threat intelligence and solutions platform. Our CSO oversees and maintains our information security management framework and is responsible for defining and implementing our information security strategy, hiring appropriate personnel, communicating key cybersecurity priorities to relevant personnel, and managing cybersecurity budgets and cybersecurity processes.


text: Our CSO seeks to regularly obtain information about relevant developments in cybersecurity, including potential threats and risk management techniques to help shape our approach to preventing, detecting, mitigating, and remediating cybersecurity threats. Our CSO is also responsible for implementing and overseeing processes for regularly monitoring our information systems and data, including the conducting of periodic audits of certain systems to identify potential vulnerabilities. The CSO reports directly to the Chief Executive Officer and provides regular updates to our Chief Financial Officer, and CLO, on certain cybersecurity risks and incidents.


text: In the event of a cybersecurity incident, the CSO initiates our incident response plan that includes actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including reporting to the Cybersecurity Committee and the Board for certain cybersecurity incidents.


text: Tenable recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and our exposure management solutions. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, critical data (including without limitation intellectual property, confidential information that is proprietary, strategic or competitive, customer vulnerability data, and information systems data), and exposure management solutions.


text: Our Information Security function is overseen by our Chief Security Officer, or CSO, and is supported by our Chief Information Officer, Chief Product Officer and Product Engineering Team Leads, Chief Legal Officer, or CLO, and Head of Global Privacy. Our Information Security function is responsible for identifying, assessing and managing cybersecurity threats and risks and works to monitor and evaluate our threat environment and risk profile using various methods. These methods include conducting vulnerability assessments and threat assessments in certain environments for internal and external threats, scanning certain threat environments, analyzing certain reports of threats and actors, conducting internal audits for certain systems, evaluating our and our industry's risk profile, coordinating with law enforcement concerning select threats, and engaging with third-party service providers to conduct external audits, threat assessments for certain systems, provide intelligence feeds, and conduct red/blue team testing and tabletop incident response exercises.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data depending on the environment. This includes maintaining an incident response plan, vulnerability management policy, and disaster recovery and business continuity plans, conducting risk assessments for certain environments, implementing certain security standards and certifications for certain products and systems, encrypting certain data in transit and at rest, controlling data access in certain environments, using multiple security controls in certain environments, segregating certain data, monitoring certain systems, performing regular security assessments for certain systems, training employees, maintaining cybersecurity insurance, maintaining dedicated cybersecurity staff, and conducting internal and external penetration tests.


text: We use third-party service providers to assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example cybersecurity consultants and software providers, managed cybersecurity service providers, threat intelligence service providers, forensic investigators, penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel and auditors. By partnering with these specialized providers, we can leverage their insights and expertise to continue to refine our cybersecurity strategies and processes.


text: We have established processes designed to manage the cybersecurity risks associated with working with third-party service providers. We evaluate the risks associated with third parties before engagement and maintain ongoing monitoring of such third parties designed to ensure compliance with our security standards. This includes security questionnaires and assessments, as well as external attack surface management. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: Our CSO is responsible for implementing and maintaining our cybersecurity risk assessment and management processes. Our CSO has over 25 years of experience in cybersecurity, including serving as a chief security and strategy officer at another company as well as serving over 20 years conducting offensive and defensive cyber operations within the intelligence community and US Cyber Command. Our CSO oversees and maintains our information security management framework and is responsible for defining and implementing our information security strategy, hiring appropriate personnel, communicating key cybersecurity priorities to relevant personnel, and managing cybersecurity budgets and cybersecurity processes.


text: Our CSO seeks to regularly obtain information about relevant developments in cybersecurity, including potential threats and risk management techniques to help shape our approach to preventing, detecting, mitigating, and remediating cybersecurity threats. Our CSO is also responsible for implementing and overseeing processes for regularly monitoring our information systems and data, including the conducting of periodic audits of certain systems to identify potential vulnerabilities. The CSO reports directly to our Co-Chief Executive Officer and Chief Operating Officer and provides regular updates to our Co-Chief Executive Officer and Chief Financial Officer and CLO on certain cybersecurity risks and incidents.


text: Triton maintains a cybersecurity risk management program designed to identify, protect, detect and mitigate cybersecurity threats and ensure the reliability of our system applications and infrastructure (our "Information Security Program"). Our Information Security Program, which is integrated within the Company's enterprise risk management framework, leverages recognized best practices and standards, including the National Institute of Standards and Technology cybersecurity framework, and is comprised of a robust set of cybersecurity tools, processes and procedures as further described below.

companyName: Triton International Ltd

ticker: TRTN-PA


text: Our internal information security team is led by Triton's Chief Information Officer, who has held this role for 14 years and holds over 30 years of experience in information technology, audit and risk management and holds certifications as a Certified Information Systems Security Professional and Certified Information Systems Auditor. Our Director, Information Security and Compliance holds over eight years of experience in cybersecurity management and oversight and over 20 years in information technology portfolio, program and application management positions. Additionally, others in our information technology team have relevant security experience and certifications. Our internal resources are augmented by external cybersecurity partners, including those described below. Our information security leadership team is responsible for assessing and managing the Company's Information Security Program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. We also take a cross-departmental approach to managing cybersecurity risk and have formed a Cybersecurity Incident Response Team ("CIRT") comprised of senior representatives from primary corporate functions as well as senior representatives from field operations to ensure a coordinated and effective response and ongoing business continuity in the face of cybersecurity threats and incidents.


text: Triton's Board is responsible for oversight of information technology and cybersecurity-related matters and monitoring cybersecurity risk management, and the Board actively engages with senior management on the state of the Company's Information Security Program. The information security leadership team prepares briefings for the Board on the effectiveness of the Company's cyber risk management program, typically on a quarterly basis, which include a review of key performance indicators, training and test results and related remediation, and recent threats and how the Company is managing those threats.


text: Triton's Information Security Program includes policies and procedures concerning cybersecurity matters, which include a cybersecurity incident response plan as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to password standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of electronic devices, electronic communications and social media. We perform routine vulnerability scanning of our network, with a focus on timely remediation of vulnerabilities. Our information security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. We periodically perform simulations and tabletop exercises at an information technology department and CIRT level and incorporate external resources and advisors as needed. All employees and certain contractors are required to complete cybersecurity trainings annually. We conduct cybersecurity phishing exercises, and follow-up training as necessary, to ensure employees maintain a high level of vigilance regarding cybersecurity risks. Using external resources, we also conduct periodic cybersecurity risk assessments, penetration tests and internal threat testing to assess our processes and procedures and the threat landscape and help guide and prioritize our cybersecurity investments and solutions. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Triton maintains dedicated backup systems and applications with enhanced ransomware protection features. In the event of an incident, we intend to follow our detailed incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying relevant functional areas, as well as senior leadership and the Board, as appropriate. We also maintain incident response service retainers with independent third parties to assist with response and recovery efforts. We continue to expand our cybersecurity investments and defenses and are establishing a cybersecurity operations center to be managed by a third party to provide 24/7 monitoring of our global cybersecurity environment and assist with coordination, investigation and remediation of alerts.


text: Triton faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Although such risks have not materially affected us to date, Triton has experienced, and will continue to experience, cyber incidents in the normal course of its business. For more information on the cybersecurity risks we face, please see "We rely on our information technology systems to conduct our business. If these systems fail to adequately perform their functions, or if we experience an interruption in our operations, our business and financial results could be adversely affected" and "Security breaches and other disruptions could compromise our information technology systems and expose us to liability, which could cause our business and reputation to suffer" under Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: Our Cybersecurity Risk Management Approach OFS Advisor utilizes the IT department ("IT Department") of CIM Group, LLC ("CIM Group"), an affiliate, as its IT administrator. The IT Department is responsible for the design and implementation of OFS Advisor's IT environment and controls, including policies and procedures to identify, assess and manage material risks from cybersecurity threats, which are integrated into OFS Advisor's internal controls and IT systems.

companyName: Hancock Park Corporate Income, Inc.


text: In collaboration with the IT Department, OFS Advisor's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. The IT Department's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. The IT Department's controls leverage the National Institute of Standards and Technology Cyber Security Framework. The IT Department also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources, including resources allocated to OFS Advisor.


text: In addition, OFS Advisor's employees receive mandatory training on cybersecurity matters at such employee's new hire and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: While we do not believe that our business strategy, result of operations or financial condition have been materially adversely affected by any cybersecurity incidents, for further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Risk Related to Our Securities and an Investment in our Common Stock—Cybersecurity risks and cyber incidents may adversely affect our business or the business of our portfolio companies by causing a disruption to our operations or the operations of our portfolio companies, a compromise or corruption of our confidential information or the confidential information of our portfolio companies and/or damage to our business relationships or the business relationships of our portfolio companies, all of which could negatively impact the business, financial condition and operating results of us or our portfolio companies."


text: Management Oversight of Cybersecurity Risk Management Management's role in assessing and managing material cybersecurity risks includes various management positions, committees and subcommittees responsible for assessing such risks. The IT Department's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation and, where appropriate, for escalation to the Board. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO"), and OFS Advisor's General Counsel (the "GC"), who has received a CERT Certificate in Cyber Oversight through the Cyber Oversight Program of the National Association of Corporate Directors, as well as representatives from CIM Group's operations, compliance and accounting departments. The Committee is also responsible for implementing our cybersecurity strategy and overseeing and managing our cybersecurity risk. In addition to the Committee's responsibilities, OFS Advisor has established a Cybersecurity Subcomittee (the "Subcommittee"). The Subcommittee consists of the CCO, the CTO, the GC, and the chief financial officer of each of OFS Advisor's public clients, including our Chief Financial Officer. The Subcommittee is responsible for overseeing our cybersecurity-related public disclosure obligations and ensuring our management and the Board is informed of material cybersecurity incidents affecting us and OFS Advisor. The Committee is chaired by CIM Group's CTO, and the Subcommittee is co-chaired by CIM Group's CTO and the CCO.


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, the IT Department and OFS Advisor maintain incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to our business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.


text: The IT Department's management responsible for developing and executing both OFS Advisor's and our cybersecurity policies, and is comprised of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.


text: We believe that the processes, policies and procedures established by the Committee and the Subcommittee provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification in accordance with applicable laws.


text: Board of Directors Oversight of Cybersecurity Risk Management Our Board has ultimate oversight of cybersecurity risks as part of our enterprise risk management program, including oversight of the processes implemented by OFS Advisor and the IT Department to identify, assess, manage and mitigate cybersecurity risks. The Board receives quarterly updates from senior management of OFS Advisor and the IT Department with respect to the effectiveness of the cyber readiness and cybersecurity program that the IT Department administers on our behalf. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by the IT Department and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by the IT Department, the health of our information security system, effectiveness of our cybersecurity controls and recoverability and business continuity testing.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Management Oversight of Cybersecurity Risk Management Management's role in assessing and managing material cybersecurity risks includes various management positions, committees and subcommittees responsible for assessing such risks. The IT Department's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation and, where appropriate, for escalation to the Board. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO"), and OFS Advisor's General Counsel (the "GC"), who has received a CERT Certificate in Cyber Oversight through the Cyber Oversight Program of the National Association of Corporate Directors, as well as representatives from CIM Group's operations, compliance and accounting departments. The Committee is also responsible for implementing our cybersecurity strategy and overseeing and managing our cybersecurity risk. In addition to the Committee's responsibilities, OFS Advisor has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of the CCO, the CTO, the GC, and the chief financial officer of each of OFS Advisor's public clients, including our Chief Financial Officer. The Subcommittee is responsible for overseeing our cybersecurity-related public disclosure obligations and ensuring our management and the Board is informed of material cybersecurity incidents affecting us and OFS Advisor. The Committee is chaired by CIM Group's CTO, and the Subcommittee is co-chaired by CIM Group's CTO and the CCO.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we used the NIST CSF as a guide to help us create our cybersecurity policy.

companyName: Highlands REIT, Inc.


text: Our cybersecurity risk management program forms a part of our overall enterprise risk management program, and shares reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Our cybersecurity risk management program is dependent on the use of external service providers to assist with our information technology security controls. Our cybersecurity policy includes a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and a third-party risk management process for relevant third-party service providers.


text: We have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We are increasingly dependent on information technology, and potential cyber-attacks, security problems, or other disruptions present risks and could disrupt our operations, result in the loss of confidential information or damage our business relationships and reputation."


text: Our Board considers cybersecurity risk as part of its risk oversight function and our Audit Committee is responsible for the oversight of cybersecurity and other information technology risks. The Audit Committee also oversees management's implementation of our cybersecurity policy. Management will update the Audit Committee, as necessary, regarding any material cybersecurity incidents.


text: Our management team, including our Chief Executive Officer, Chief Operating Officer and Chief Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and retaining external information technology providers. The members of our management team do not have specialized cybersecurity backgrounds but have general experience managing financial, insurance, legal and operational risks. Our management team utilizes a third-party outsourced information technology service provider to monitor security events and actively respond to potential security incidents. If a security incident is identified, management in conjunction with the outsourced information technology service provider will take the appropriate actions to mitigate and remediate the security incident in a timely manner. Either during the incident, or post remediation, management will determine the materiality of the incident and if deemed material, will inform the Audit Committee and disclose the incident pursuant to SEC rules and regulations.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing Company's our risk management processes, including oversight and mitigation of risks from cybersecurity threats. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data (including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, "Information Systems and Data").


text: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our Information Systems Representative and Chief Operating Officer identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We use various methods designed to accomplish this task including, for example: manual and automated tools, subscriptions to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, and evaluating threats reported to us.


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response strategies, systems monitoring, personnel training, cybersecurity insurance, data encryption strategies, network security controls, access controls, physical security controls, and asset management (such as tracking and disposal of Company information systems).


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our IT Department works with management in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity software providers and professional services firms (including legal counsel). We also use service providers to perform a variety of functions throughout our business, such as application providers, data hosting providers, and CROs. We have a vendor management strategy designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management strategies may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, such as reviewing their information security documentation and imposing contractual obligations on them with respect to their information security controls.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our internal information systems, those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences including, but not limited to, regulatory investigations or actions, litigation, fines/penalties, disruptions of our business operations, reputational harm, and loss of revenue or profits.


text: Our Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, threats, risks and mitigation. Our Audit Committee also receives information regarding certain cybersecurity risks that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.


text: Our Information Systems Representative, in coordination with senior management including our Chief Operating Officer works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout our company address cybersecurity threats and respond to and escalate certain cybersecurity incidents. Through ongoing communications with these teams, the Information Systems Representative and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Audit Committee when appropriate. The Information Systems Representative has served in various roles in information technology and information security for over 26 years, including serving as the Director of Information Technology of another public company. Our Chief Operating Officer has over 7 years of experience managing information technology, including cybersecurity and risk management.


text: As an externally managed company, BREIT's day-to-day operations are managed by the Adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior Blackstone Real Estate professionals and our Adviser is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by BREIT, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI"), and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP"), designed to inform the proper escalation (including, as appropriate, to BREIT's senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by our CSO and members of BXTI and Legal and Compliance.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone such as BREIT. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "Part 1. Item 1A. Risk Factors – Risks Related to Our Organizational Structure – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations" in this Annual Report on Form 10-K.


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity strategy, which applies to BREIT.


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO, Adam Fletcher, is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. Prior to his appointment as CSO in 2017, Mr. Fletcher was Blackstone's Deputy CSO. Before joining Blackstone in 2014, Mr. Fletcher led the International Security organization for Equifax from 2012 to 2014. Mr. Fletcher received a BS in Operations Research and Industrial Engineering from Cornell University.


text: Blackstone's CTO, John Stecher, is a Senior Managing Director and head of BXTI. Mr. Stecher is responsible for all aspects of technology across Blackstone. Mr. Stecher also advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and companies externally managed by Blackstone such as BREIT, on technology-related matters. Before joining Blackstone in 2020, Mr. Stecher was a Managing Director and the Chief Technology Officer and Chief Innovation Officer at Barclays. He was also a member of the Barclays Technology Management Committee. Prior to joining Barclays in 2017, Mr. Stecher held a variety of senior management and engineering roles across Goldman Sachs' capital markets and technology divisions. Mr. Stecher received a BS in Computer Science from the University of Wisconsin – Madison and a MS in Computer Science from the University of Minnesota.


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO review Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.


text: BREIT's board of directors is responsible for understanding the primary risks to our business. The audit committee of BREIT's board of directors is responsible for reviewing BREIT's and the Adviser's IT security controls with management and evaluating the adequacy of BREIT's and the Adviser's IT security program, compliance and controls with management.


text: Blackstone's CSO reports to both our executive officers as well as our board of directors and/or our audit committee annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such annual reports, our board of directors and/or the audit committee receive periodic updates from Blackstone on the primary cybersecurity risks facing us and our Adviser and the measures we and our Adviser are taking to mitigate such risks, as well as on changes to our and our Adviser's cybersecurity risk profile or certain newly identified risks.


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by BREIT, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI"), and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any cybersecurity events Blackstone experiences are reviewed, discussed, and incorporated into its incident response processes, as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP"), designed to inform the proper escalation (including, as appropriate, to BREIT's senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by members of BXTI and Legal and Compliance.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to identify, track and treat cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone such as BREIT. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity program and strategy, which applies to BREIT.


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. He has over 25 years of information security, technology and engineering experience, including having previously led the international security organization at a large credit bureau.


text: Blackstone's CTO is a Senior Managing Director and the head of BXTI. Blackstone's CTO has over 23 years of information security, technology and engineering experience, including having previously served as the Chief Technology and Chief Innovation Officer at a large financial institution. Blackstone's CTO is responsible for all aspects of technology across Blackstone, advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and companies externally managed by Blackstone such as BREIT, on technology-related matters.