text: Cyber Risk Management The Company recognizes the increasing significance of cybersecurity threats in today's digital landscape and has implemented a cyber risk management program to identify, assess, manage, mitigate and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management program. Our approach is designed to safeguard sensitive information, protect critical assets and maintain the integrity of our operations.

companyName: DNOW Inc.

ticker: DNOW


text: Our cyber risk management program includes: • Regular assessments of cyber risks, taking into account the evolving threat landscape, technological advancements and changes in our business operations. • Proactive identification and mitigation of vulnerabilities in our information systems through regular scanning, testing and patch management. • Implementing and continuously monitoring security controls, including firewalls, intrusion detection systems, encryption and access controls, to safeguard against unauthorized access and data breaches. Our controls are based on the latest Center of Internet Security (CIS) Critical Security Controls best practices for cybersecurity and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). • Regular testing of our Cyber Incident Response Plan through tabletop exercises to ensure a swift, coordinated and effective response in the event of cyber incidents to minimize impact on operations.

secItem: Item 1C


text: Cybersecurity Strategy Our cybersecurity strategy is aligned with our overall business objectives and includes the following key elements: • Implementation of multiple layers of security controls, including firewalls, intrusion detection and prevention systems, endpoint protection and encryption, to safeguard our information assets. • Ongoing education programs for employees to enhance their awareness of cyber risks and promote a culture of cybersecurity throughout the organization.


text: Our governance structure is designed to ensure effective oversight and management of cybersecurity risks: • The Board of Directors is actively engaged in overseeing cybersecurity matters, receiving regular briefings and ensuring alignment between cybersecurity strategy and overall business strategy. • A dedicated committee oversees cybersecurity governance, assessing policies, practices and risk mitigation strategies and ensuring alignment with industry best practices. • Our executive leadership team actively participates in the development and execution of cybersecurity strategy, reinforcing the importance of cybersecurity at the highest levels of the organization.


text: Regulatory Compliance We remain committed to complying with all relevant cybersecurity regulations and standards applicable to our industry. Our governance structure is designed to adapt to evolving regulatory requirements and industry best practices.


text: While we believe our current measures are robust, we recognize the dynamic nature of cyber threats and continually refine our approach to remain vigilant and responsive.


text: This disclosure provides stakeholders with a comprehensive overview of the organization's cyber risk management, strategy and governance practices, demonstrating a commitment towards proactive cybersecurity measures and compliance.


text: No unauthorized access to customer, vendor, supplier, joint venture, employee or our data occurred as a result of cybersecurity incidents against us that has had a material adverse effect on our business, operations, or consolidated financial condition. See additional information about our cybersecurity risks under Risks Relating to Our Business in Item1(a) Risk Factors.


text: We collect, use and store personal information of our employees, consumers and other third parties in the ordinary course of business. In addition, we sell certain products directly to consumers online and through websites, mobile apps and connected devices, and we offer promotions, rebates, loyalty and other programs through which our data systems may receive personal information. We recognize the importance of data privacy and security and are committed to safeguarding and protecting our information and any other information entrusted to us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information which is integrated with our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan to respond to security breaches and cyberattacks. Our cybersecurity incident response plan is part of our overall Information Security Program, which is led by the Company's Vice President, Global Chief Information Security Officer ("CISO") and overseen by the Company's Senior Vice President, Global Chief Information Officer, and is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company, and the Company's ability to operate. Our cybersecurity incident response plan includes controls and procedures for timely and accurate reporting of any material cybersecurity incident. We design and assess our program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our global enterprise IT environment; • a security team responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to security breaches and cyberattacks; • the use of external service providers, where appropriate, to assess, perform tabletop exercises or otherwise assist with aspects of our security controls and designed to anticipate cyberattacks and respond to breaches, including an annual maturity assessment of our program by an external third-party; • cybersecurity awareness training of our employees and contractors, incident response personnel, and senior management to help them better understand the issues and risks relative to cybersecurity, as well as data privacy (for our employees); • Periodically throughout the year, our IT department performs phishing and other exercises to both test our systems and reinforce training of our personnel; • a cybersecurity incident response plan managed by our CISO that includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of all information possessed by the Company; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or cash flows.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes.


text: The Audit Committee, which is tasked with oversight of certain risk issues, including cybersecurity, receives reports from the Senior Vice President, Global Chief Information Officer and the Vice President, Chief Information Security Officer each quarter. At least annually, the Board of Directors and the Audit Committee also receive updates about the results of exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and our internal response preparedness. The Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board also receives periodic briefings regarding our Information Security Program and cyber threats, including threats faced by our peers, in order to enhance our directors' literacy on cyber issues. In addition, management will update the Audit Committee, as necessary, regarding cybersecurity incidents, that we may experience.


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Directors. Our executive officers are senior professionals of the Adviser and Sixth Street and each of the Adviser and Administrator is a subsidiary of Sixth Street. As such, we are reliant on Sixth Street for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Sixth Street has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: Sixth Street maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Sixth Street utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software, among others.


text: Sixth Street tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Further, Sixth Street engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by Sixth Street's Technology Risk team in collaboration with outside service providers as appropriate and includes members of Sixth Street's senior management and Legal/ Compliance team. Learnings from these tabletop exercises and any events that Sixth Street experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Sixth Street's internal exercises to test aspects of its cybersecurity program, Sixth Street periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Sixth Street's information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.


text: Sixth Street has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our executive officers and other representatives of the Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.


text: Sixth Street maintains a cybersecurity risk management process to identify and mitigate risks that impact the firm. Sixth Street's Head of Technology Risk periodically discusses and reviews cybersecurity risks and related mitigants with Sixth Street's Cybersecurity Committee and incorporates relevant cybersecurity risk updates and metrics.


text: Sixth Street employs a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on the Sixth Street and its affiliates in managing these risks, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Sixth Street has a dedicated cybersecurity team, led by its Head of Technology Risk, who works closely with Sixth Street's Cybersecurity Committee, to develop and advance the firm's cybersecurity strategy, which applies to us. Sixth Street's Cybersecurity Committee includes its Chief Information Officer, Chief Risk Officer, General Counsel, Co-Chief Operating Officer and Chief Compliance Officer, as well as our Chief Financial Officer and Chief Compliance Officer.


text: The Head of Technology Risk has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across Sixth Street. He has a B.S in Computer Science from University of Washington and has over 17 years of experience contributing to cybersecurity related workflows, processes, policies, system designs, program management, and vulnerability discovery, exploitation, mitigation, and remediation.


text: Sixth Street conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The Head of Technology Risk reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. The Head of Technology Risk also reviews the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Sixth Street's information and systems.


text: Our Board of Directors is responsible for understanding the primary risks to our business, including any cybersecurity risks. The Board of Directors is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Sixth Street's Head of Technology Risk reports to the Board of Directors at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board of Directors may receive updates from management as to our and the Adviser's cybersecurity risks and Sixth Street cybersecurity program developments.


text: As part of our cybersecurity risk management framework, we have implemented comprehensive Corporate Incident Response Plans (IRPs) and other policies and procedures designed to ensure the assessment, identification, and management of material risks from cybersecurity threats, and to facilitate timely disclosure of material cybersecurity incidents in accordance with SEC rules. Our policies provide for cybersecurity awareness training for employees and engagement in due diligence processes in accordance with industry best practices for third-party vendors, including those handling critical services or sensitive data on our behalf. Our policies also provide for regular, senior management-led table-top exercises simulating cyberattack scenarios to ensure preparedness and response agility. We undertake an annual review of our policies to help ensure their effectiveness and relevance in light of evolving cybersecurity threats. Additionally, we maintain cyber insurance to help cover costs associated with the occurrence of certain cybersecurity events. We do not currently engage any other third parties as part of our cybersecurity risk management framework, but we do use third party services and products in the ordinary course with respect to certain common cybersecurity threats.

companyName: Strategy Inc

ticker: MSTR


text: Our IRPs, which are tailored to address potential cybersecurity threats in both our product and corporate infrastructure technology environments, are designed to provide a comprehensive, structured response to cybersecurity incidents, and apply to all MicroStrategy personnel, including employees, directors, temporary staff, and contractors. In accordance with our IRPs, we train our personnel to report any cybersecurity incidents to our Information Security Team (IST). Upon identification of a cybersecurity incident, the IRPs mandate that the IST conduct an immediate evaluation and assign a severity rating to the incident and, depending on the severity, report the incident to our Chief Information Security Officer (CISO). Based on the severity of the incident, a Security Incident Response Team (SIRT), the members of which include our Chief Information Officer (CIO), the CISO, and personnel from various departments, including legal, is convened. The SIRT, with assistance from the IST, is tasked with executing a timely and effective response to the incident, and SIRT members are assigned specific roles and responsibilities, including assessment of the incident's materiality for disclosure purposes.


text: Our CIO and CISO oversee our cybersecurity preparedness. Our CIO has over 25 years of experience in the technology sector, including specifically in the cybersecurity industry, and held various leadership positions prior to joining MicroStrategy in 2018. Our CISO, who joined MicroStrategy as CISO in 2021, has over 20 years of experience with cybersecurity and privacy, and has experience with IT infrastructure technologies, including cloud, network, server, endpoint, and mobile technologies. Our CISO holds a master's degree in computer science and multiple industry-recognized cybersecurity certifications. The IST operates under our CISO's leadership, who in turn reports to our CIO.


text: We administer our cybersecurity risk management framework separately from our other risk management systems and processes, under the direct oversight of our board of directors and senior management. MicroStrategy's management, including our CIO and CISO, provides the board of directors with regular updates on cybersecurity incidents and emerging threats. The board actively engages with management on the development and implementation of cybersecurity policies and practices, offering insights and guidance. Board members with significant experience in software technology, such as Michael J. Saylor and Leslie J. Rechan, each with over 30 years of software industry experience, and Phong Le, our Chief Executive Officer, contribute their expertise to our cybersecurity risk management.


text: Unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our third-party vendors, through various means, such as hacking, social engineering, phishing, and fraud. However, such incidents have not materially affected, nor are they reasonably likely to materially affect, our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors – Risks Related to Our Bitcoin Acquisition Strategy and Holdings – If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected" and "Item 1A. Risk Factors – Risks Related to Our Operations – If we or our third-party service providers experience a disruption due to a cybersecurity attack or security breach and unauthorized parties obtain access to our customers', prospects', vendors', or channel partners' data, our data, our networks or other systems, or the cloud environments we manage, our offerings may be perceived as not being secure, our reputation may be harmed, demand for our offerings may be reduced, our operations may be disrupted, we may incur significant legal and financial liabilities, and our business could be materially adversely affected."


text: We recognize that our clients entrust us with highly sensitive data. We also recognize our attendant responsibility to safeguard the accessibility, confidentiality, and integrity of this data. Our information security program consists of policies, procedures, systems, controls and technology designed to help us prevent, identify, detect and mitigate cybersecurity risks. Our processes are informed by cybersecurity events we have observed within the Company, across our industry, and across the cybersecurity landscape. We utilize the risk management framework for risk assessments as defined by the ISO 27001 Information Security Management Standard. We have integrated cybersecurity risk management into our overall risk management framework by conducting annual enterprise risk management assessments and IT risk management assessments, implementing periodic key risk indicator tracking, and holding periodic meetings among multiple department stakeholders to address cybersecurity risks. We review our information security policies at least annually and in connection with certain process changes to ensure that they meet the needs of the organization and the goals and objectives of the information security program.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Prevention, Identification, Detection and Mitigation Activities We routinely undertake activities to prevent, identify, detect and mitigate risks from cybersecurity threats, including but not limited to the following: • Procedures and guidelines designed to ensure that information security is a key consideration in the requirements for both new information systems and enhancements to existing systems and assets; • IT environment risk assessments conducted at regular intervals and in connection with certain events, such as implementation of a new system, service or vendor; • Tabletop and simulation exercises to discuss roles and responsibilities of team members in the event of a cybersecurity incident and to test and modify the plan as needed; • Ongoing security penetration testing and threat modeling of our network and web application; • Automated tools and manual review processes to ensure ongoing compliance with technical standards and identify configuration issues and technical vulnerabilities; • Encryption of all communications with our servers, which are configured to utilize only high-grade encryption algorithms; and • Ongoing employee training related to information security and data privacy policies and standards, including periodic phishing, vishing, and social engineering exercises.


text: We also have implemented and continue to maintain policies, procedures, systems, controls and technology to oversee and identify the cybersecurity risks associated with our use of third-party service providers. For example, we conduct thorough cybersecurity risk assessments of all third-party service providers prior to engagement and ongoing monitoring to ensure compliance with our robust cybersecurity requirements. The monitoring includes periodic audits of third-party systems and vendors. We engage third-party consultants and auditors in connection with assessing, identifying and managing material risks from cybersecurity threats. Our collaboration with these third parties includes independent audits, threat assessments, and consultation on security enhancements.


text: Infrastructure; Network and Physical Security Our IT infrastructure is secured and monitored using a number of leading practices and tools across physical and logical security. This security is also continually monitored by our information security department. We strictly regulate and limit all access to servers and networks at each of our facilities. Local network access is restricted by domain authentication, using stringent access control lists. Remote network access is restricted by a defense-in-depth approach that includes redundant firewalls, preventing unauthorized access from external networks to systems within our local network. We also employ (i) network and endpoint intrusion detection, intrusion prevention, and data loss prevention sensors throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our continuously staffed security operations center of potential cybersecurity issues, and (iii) a seasoned process for managing and installing patches for third-party applications.


text: We maintain plans to address any cybersecurity incidents, including but not limited to Crisis Management Policies and Procedures, an Incident Response Plan, an Information Security Incident Management Policy and a Business Resiliency/Continuity Management Policy. Information security continuity is embedded in our business continuity management system to minimize the risk that continuity operations could result in a compromise to our security standards. We conduct business continuity, crisis communications and disaster recovery exercises at least annually to test and modify the plan, as needed. The activities related to the business continuity management system are routinely reported to executive management as part of our IT security team's ongoing metrics reporting. In addition, reports related to activities and outcomes are provided to the audit committee on a quarterly basis.


text: Certifications and Audits We maintain the following ISO certifications related to our information systems: • ISO 22301:2019 (standard for implementing and managing an effective business continuity management system); • ISO/IEC 27001:2013 (security standard for information security management systems, covering our production, quality assurance and implementation environments); • ISO 27701:2019 (standard for establishing, implementing, maintaining and continually improving a privacy information management system); and • ISO 9001:2015 (standard for the implementation of quality management processes).


text: We voluntarily obtain third-party security examinations relating to our internal controls over financial reporting in accordance with SOC 1. Our SOC 1 examination is conducted every six months by one of the four largest independent international auditing firms, and addresses, among other areas, our physical and environmental safeguards for production data centers, data availability and integrity procedures, change management procedures and logical security procedures. We also obtain third-party examinations relating to our internal controls over security and privacy in accordance with SOC 2. Our SOC 2 examination is conducted every year and addresses, among other areas, internal controls around security, availability, processing integrity, confidentiality and privacy. We publish SOC 1 reports semiannually and SOC 2 and SOC 3 reports annually.


text: Impact of Risks from Cybersecurity Threats We have experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on our business strategy, results of operations, or financial condition to date, any actual or perceived breach of our security could damage our reputation, cause existing clients to discontinue the use of our solution, prevent us from attracting new clients, or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect our business strategy, results of operations, or financial condition.


text: Both management and the Board of Directors are actively involved in the oversight of risks from cybersecurity threats. Our information security program is designed to ensure that management and the Board of Directors are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) our efforts related to the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of the Board of Directors The Board of Directors has delegated to the audit committee primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The audit committee receives quarterly reports and updates from our Chief Information Officer and Executive Vice President of IT and Information Security with respect to cybersecurity risk management. Such reports cover the Company's information security program, including its current status, capabilities, objectives and plans, as well as the evolving cybersecurity threat landscape.


text: Role of Management The Chief Information Officer oversees the activities of our IT and information security teams. Our Chief Information Officer has been with Paycom since 2005 and has more than 30 years of IT and software development experience. The Executive Vice President of IT and Information Security, who reports to our Chief Information Officer, is responsible for ensuring that both new implementations and ongoing operations comply with the policies, procedures, and guidelines of our information security program. Our Executive Vice President of IT and Information Security has been with Paycom for over a decade and has worked in technology development, improvement, infrastructure, and security for over 25 years. The Executive Vice President of IT and Information Security is supported by our Director of IT Security, who has worked in technology development, improvement, infrastructure, and security for over a decade. The Director of IT Security is responsible for the growth and implementation of the information security and data privacy programs and oversees the operations of the information security team. The Director of IT Security also provides oversight for information security and privacy policies and controls, oversees compliance activities, and provides metrics and guidance to executive management regarding the program. The aforementioned leaders and teams have a breadth of experience and manage programs related to governance, risk, and compliance; data privacy and security; vulnerability management; security operations; and application security.


text: The Chief Information Officer is regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. As discussed above, our information systems are routinely reviewed for compliance with information security policies and standards. Outcomes of reviews and audits are reported to the Director of IT Security, Executive Vice President of IT and Information Security, and the Chief Information Officer. Relevant information about security nonconformities, incidents, and events are reported to the working group described below and to the Board of Directors. As discussed above, the Chief Information Officer and Executive Vice President of IT and Information Security report to the audit committee and the Board of Directors on cybersecurity matters at least quarterly.


text: In addition, we have established a working group composed of senior leaders from various departments, including operations, finance, IT, information security, audit, and legal. This working group's responsibilities include (i) ensuring that information security goals and objectives are identified, meet organizational and business requirements, and are integrated into relevant processes, (ii) reviewing the effectiveness of the information security program, (iii) providing clear direction and highly visible management support for security initiatives, (iv) providing resources required for information security projects and initiatives, (v) overseeing programs to maintain information security awareness, including training and team-specific guidance, and (vi) coordinating the information security aspects of supplier relationships.


text: Our information security program is managed by our Chief Security Officer and VP of Security Engineering ("CSO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, technologies, and processes. Our CSO's primary responsibility includes assessing, monitoring, and managing our cybersecurity risks. With over 24 years of experience in the field of cybersecurity, our CSO brings a wealth of experience to her role. Her background includes extensive experience as an enterprise CSO, and she is well recognized within the industry. Her in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. In partnership with our Chief Information Officer ("CIO") who leads our Governance Risk and Compliance ("GRC") function, our CSO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee security training program.

companyName: JFrog Ltd

ticker: FROG


text: The CSO works to stay informed about relevant developments in cybersecurity, including potential threats and innovative risk management techniques. The CSO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and advanced compliance systems to identify potential vulnerabilities and mitigate them. The CSO collaborates closely with various key departments within the company – including the office of our Chief Technology Officer ("CTO"), Engineering, IT, DevOps, Support, and Production – to implement our Vulnerability Management Remediation Plan. This collaboration is aligned with industry standards of the Software Development Life Cycle, underscoring our commitment to maintaining robust security protocols across all phases of our operations.


text: We have developed and maintain a robust cybersecurity incident response plan, led by the CSO. JFrog's cybersecurity incident response team has a comprehensive strategy and policies in place for managing security incidents. Along with swift threat classification, containment, and eradication, the strategy includes notification procedures to promptly inform and support stakeholders in accordance with applicable data breach notification laws. Incident analysis is carried out to understand root causes and drive continuous improvement.


text: Our information security controls and practices are certified against globally recognized standards: ISO 27001, ISO 27701, ISO 27017, SOC 2 Type II. We are also aligned to cybersecurity practices and controls recommended by the National Institute of Standards and Technology (NIST), part of the U.S. Department of Commerce.


text: Our third-party vendor risk management program addresses third party vendors with access to our systems or data, or processing data on our behalf, and includes a risk-based approach and security assessments throughout the third-party life-cycle, from onboarding to termination, as well as through contractual controls and technological controls to monitor the vendors posture. This program is designed to oversee and identify risks from cybersecurity threats associated with its use of any third-party service providers.


text: Training and Awareness Our employees undertake cybersecurity and data privacy training during onboarding and the majority of our employees complete annual refresher modules. JFrog also maintains a secure-code training program for developers and quarterly phishing simulation to improve our employees' awareness and resilience. Employees who do not meet our performance expectations in such simulations are required to undergo additional training.


text: Engagement with Third-Parties on Risk Management Given the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, helping our cybersecurity strategies and processes remain consistent with applicable generally adopted industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and penetration testing; consultation on security enhancements; bug bounty program for identifying security weaknesses in our products and services; designing partnership with third party vendors; using our inhouse security tools as customers; and global incident response experts for potential critical cybersecurity events.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For more detailed information about the cybersecurity risks we face, please see Item 1A, "Risk Factors," in this annual report on Form 10-K, including Risks Related to Privacy, Data Protection and Cybersecurity: "A breach of our security measures or unauthorized access to proprietary and confidential data, or a perception that any security breach or other incident has occurred, may result in our platform or products being perceived as not secure, lower customer use or stoppage of use of our products, and significant liabilities."


text: Our Board of Directors has established robust oversight mechanisms to support effective governance in managing risks associated with cybersecurity threats. All of our Board members have experience in the tech industry. Data protection under their guidance and oversight remains a strategic priority at the highest levels of our organization. The Audit Committee is responsible for oversight of our information security program and is consulted with at least twice a year by management. Our VP of Internal Audit leads an annual internal audit plan, and its status and internal audit findings are reported to the Audit Committee on a quarterly basis. Our cybersecurity strategies and initiatives are refined by the continuous dialogue and the rich insight of our Board members.


text: Our CTO who is also a Board member, has established the CSO Office at JFrog. Our CTO and CSO have extensive experience assessing and managing cybersecurity programs and cybersecurity risks, and they work closely to define the initiatives of our cybersecurity program, the CSO organization structure and cyber business continuity plan planning. Our CTO is updated regularly on the status of our cybersecurity program. This allows us to address emerging threats and make informed decisions in real-time and to protect our systems on a timely basis. Over the past two decades, our CIO has held various positions in information technology and information security, including as CIO in two public companies, managing and controlling cybersecurity long-term programs and risks. Governance, Risks and Compliance (GRC) is managed by the CIO team, while cross-GRC activities are managed by the team, in alignment with the CSO.


text: Risk assessments are periodically conducted by our VP of Internal Audit. Internal audits are conducted and reported to the Audit Committee on a quarterly basis.


text: We have an enterprise-wide information security program designed to protect our information systems from cybersecurity threats. We identify and assess risks from cybersecurity threats by monitoring and evaluating our digital assets and our risk profile using various methods. We monitor security events that are internally discovered or externally reported that may affect our systems and have processes and procedures to assess those events for potential cybersecurity impact or risk and consequently improve our security measures and planning. Additionally, we work with third parties from time to time that assist us in refining our cybersecurity risk strategy in order to identify, assess and manage cybersecurity risks, including professional services firms and consulting firms. We seek to detect and investigate unauthorized attempts and attacks against our network and services, and to minimize their occurrence and recurrence through changes or updates to our internal processes and tools and changes or updates to our services; however, we remain potentially vulnerable to known or unknown threats.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity events to members of management depending on the circumstances. Key members of management, including representatives from IT, operations, legal, finance, risk management and internal audit, serve on the Company's senior security incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified, and certain cybersecurity incidents are escalated to the Company's executives. In addition, the Company's incident response processes include potential reporting to the Audit Committee of our Board of Trustees for certain cybersecurity incidents.


text: We also have a third-party risk management program in place to manage cybersecurity risks associated with third-party service providers. While we do maintain processes and procedures to identify, prioritize and assess risks associated with third-party service providers, we must rely on third parties to augment our security program, and we cannot ensure in all circumstances that their efforts will be successful.


text: While to date we have not experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Any significant disruption to our systems could adversely affect our business and results of operations. Further, a cyber incident impacting our systems or a third-party's systems could subject us to business, regulatory, litigation and reputational risk, which could have a negative effect on our business, financial condition and results of operations.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A, Risk Factors, for a discussion of cybersecurity risks.


text: Our Information Technology Security Team, under the oversight of our Senior Vice President of IT and the leadership of our VP of IT Infrastructure and Security, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Information Technology Security Team manages and continually enhances a robust enterprise security structure with the ultimate goal of minimizing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Our Information Technology Security Team possesses decades of experience in navigating cybersecurity threats and mitigating associated risks as a result of holding similar positions at other large companies. Most members of the team hold degrees in cybersecurity and/or related disciplines, have cybersecurity certifications such as Certified Information Systems Security Professional (CISSP) and/or periodically attend various cyber-focused conferences and training programs. Specifically, our Senior Vice President of IT and our VP of IT Infrastructure and Security combined have over 30 years of technology and cybersecurity experience. The team provides regular reports to senior management and affected departments on various cybersecurity threats, assessments and findings.


text: The Audit Committee of our Board of Trustees oversees our annual enterprise risk management assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. The Audit Committee oversees our ongoing cybersecurity risk management efforts and regularly receives detailed reports from representatives of our Information Technology Security Team addressing a wide range of related topics. At least annually, our IT leadership (and external cybersecurity experts if applicable) reviews key cybersecurity strategies and policies with the full Board of Trustees, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends and other areas of importance.


text: We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed yearly by our Board of Directors.

companyName: MEDICINOVA INC

ticker: MNOV


text: As of December 31, 2023, we have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees and contractors receive annual cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: Our Information Technology General Controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have utilized an outsourced information technology consultant to reduce and monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us, including prompt escalation and communication of major security incidents to senior business leadership and our Board of Directors.


text: Our Board of Directors is responsible for overseeing our cyber security risk management and strategy. Our senior leadership, including our Chief Executive Officer and Chief Financial Officer, regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors".


text: We maintain comprehensive programs and technologies to ensure that our information systems are effective and prepared for data privacy and cybersecurity risks, including regular oversight of our security programs for monitoring internal and external threats to ensure the confidentiality and privacy of our data. As the volume and complexity of cyber-attacks continue to evolve, we continue to enhance our security capabilities by continued investment in cyber technologies, further developing our internal cybersecurity personnel and educating our workforce regarding cybersecurity, and leveraging emerging technologies.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: Risk Management and Strategies We regularly perform evaluations of our security program and continue to implement controls aligned with industry guidelines to identify threats, detect attacks and protect data. Our risk management strategy is focused on three areas: (i) technology, being our hardware and software systems; (ii) processes, being our cybersecurity reporting, testing and other processes; and (iii) people, which refers to our internal cybersecurity personnel, external service providers and individual training and human interaction within our information technology and cybersecurity processes. We seek to align our cybersecurity program with practices recommended under ISO 27001 and by the National Institute of Standards and Technology and the Center for Internet Security Critical Security Controls.


text: When reviewing third party information technology service providers, our engagement process customarily includes, among other things, a review of such providers' cybersecurity measures. Additionally, we use third party data, such as Security Scorecard, to review and monitor such providers and as an indicator in respect of our cybersecurity environments.


text: We periodically undertake cybersecurity audits, the results of which are reported to our Audit Committee. We have also implemented security monitoring programs designed to alert us of any suspicious activity, and have developed an incident response program in the event of a security breach.


text: We implement various training programs periodically to ensure that our employees and other personnel comply with internal processes and to enhance their cybersecurity awareness.


text: Additionally, we have engaged third party providers to supplement our response capabilities for both informational and operational technology incidents, as needed.


text: See also Item 1A. "Risk Factors – Risks Related to our Business - Failures or security breaches of our information technology systems could disrupt our operations and negatively impact our business".


text: Our board of directors oversees our risk management processes and has tasked our Audit Committee with oversight of our cybersecurity and information governance, including periodically reviewing and discussing with management our risk exposures relating to data privacy and cybersecurity, and reviewing the steps we have taken to identify, assess, monitor, mitigate and manage such exposure and cybersecurity risks. At the management level, our Director of Cybersecurity is responsible for overseeing our cybersecurity processes and risk management, working together with our Chief Information Officer to implement our cybersecurity initiatives.


text: Our Audit Committee and management meet with the Board on a quarterly basis to provide updates on cybersecurity risks, material cyber-attacks and security incidents as they occur, as well as to promote company-wide cyber risk and security awareness. Additionally, our Chief Information Officer and Director of Cybersecurity meet periodically with the Board or the Audit Committee to brief them on technology and information security matters.


text: Our Director of Cybersecurity is informed of any cybersecurity incidents by applicable personnel, and oversees remediation efforts in accordance with our processes. Our Chief Information Officer reports to our Audit Committee on significant incidents periodically. Our Director of Cybersecurity has over 20 years of experience as a cybersecurity and information technology professional and holds the Certified Information Systems Security Professional designation.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes the implementation of a cybersecurity incident response plan.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: We design and assess our program based on industry standards to align closely with information security frameworks and guidelines. This does not imply that we meet or are in compliance with any particular technical standards, specifications, or requirements, only that we use the frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We utilize a commercially available third-party hosted cloud network environment with commercially available systems, software, tools and monitoring to provide security to protect its information and data and alert it to potential information security breaches. The third party engaged by us to oversee and host its network was engaged, in part, because of its experience with information security and data protection and products designed to manage against information and data security breaches. We conduct mandatory annual cybersecurity training for employees and have information security and data privacy policies and procedures in place applicable to our directors, officers, and employees.


text: In 2022, we engaged an outside consultant to conduct a comprehensive cybersecurity assessment, the methodology for which was based on information security frameworks and guidelines such as the National Institute of Standards and Technology (NIST), Center for Information Security (CIS), and ISO 27001. Management reviewed the results of the assessment with the Audit Committee and, throughout 2023, engaged with consultants, auditors, and other third parties to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. To date we had no cybersecurity incidents.


text: For additional information, see "Item 1A. Risk Factors - We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business. Additionally, our failure to comply with applicable privacy, data security or protection or cyber security laws could adversely affect our business."


text: Our Board of Directors actively considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risk to the Audit Committee. The Audit Committee is instrumental in overseeing the implementation of our cybersecurity risk management program by management.


text: The Audit Committee receives detailed quarterly reports from management about our cybersecurity risks, and management provides timely updates to the Audit Committee about any significant cybersecurity incidents, as well as those with lesser impact potential if deemed appropriate to do so.


text: The Audit Committee informs the full Board of Directors about its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cybersecurity risk management program. Members of the Board of Directors are kept abreast of cybersecurity developments through presentations by our Chief Financial Officer or external experts as part of their ongoing education on issues impacting public companies.


text: Our management team, including our Chief Financial Officer, and members of the Audit Committee play a pivotal role in assessing and managing material risks stemming from cybersecurity threats. The management team is primarily responsible for the oversight of our overall cybersecurity risk management program, and coordinates with our external cybersecurity consultants.


text: Efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents are supervised by our management team. These efforts include briefings from internal security personnel, leveraging threat intelligence and information from governmental, public, and private sources, engagement with external consultants, and utilizing alerts and reports generated by our security tools within the IT environment.


text: Trustmark recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats. Trustmark is committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard its systems and data.

companyName: TRUSTMARK CORP

ticker: TRMK


text: Trustmark's Board of Directors has ultimate oversight of cybersecurity-related risks and it is assisted in this role by the Enterprise Risk Committee and the Audit Committee. Processes for identifying, assessing and managing cybersecurity-related risks are integrated into Trustmark's overall enterprise risk management process, which is overseen by the Enterprise Risk Committee. The Enterprise Risk Committee is responsible for monitoring risks that are being taken by Trustmark, understanding the enterprise-wide effect of those risks and reporting such risks to the Board. In fulfilling this role, the Enterprise Risk Committee has primary oversight responsibility over management's efforts to manage and mitigate cybersecurity-related risk and reviews and approves Trustmark's cybersecurity strategy for protecting Trustmark's information assets and technology platforms. The Audit Committee oversees Trustmark's Internal Audit Department, which conducts reviews and assessments related to information security. Management provides periodic reports to the Enterprise Risk Committee and the Audit Committee, both of which provide reports of their meetings to the full Board. These reports to the Board and its Committees address the threat environment, vulnerability assessments, specific cyber incidents and management's efforts to monitor, detect and prevent cyber threats.


text: Trustmark's information security program is primarily administered at the management level by the Information Security Department, which is led by Trustmark's Chief Information Security Officer (CISO), and is supported by the Information Technology Department, which is led by Trustmark's Chief Information Officer (CIO). The CISO reports to the CIO, who in turn reports to Trustmark's Chief Credit and Operations Officer. Trustmark's Information Security Department is responsible for day-to-day management of Trustmark's information security program, including data loss prevention, access control, threat monitoring, incident response and employee education and training. The Information Security Department also maintains policies related to cybersecurity and data security that provide the required governance for the information security program. Additionally, Trustmark's Information Technology Department maintains policies that govern technical aspects of Trustmark's information security program. Each policy is reviewed and approved by the Enterprise Risk Committee at least every three years and is mapped to applicable regulatory guidance. The Cybersecurity Operations team within the Information Technology Department maintains and runs Trustmark's security operations center and is responsible for cybersecurity event management and maintaining security tooling. Trustmark also maintains an Information Security / Cybersecurity Management Committee, which is comprised of representatives from the Information Security, Information Technology, Enterprise Risk, Corporate Security, Internal Audit and Legal departments and members of executive management. This committee meets quarterly to discuss and review Trustmark's information security program and receives qualitative and quantitative update reports from the Information Security Department, Internal Audit Department and Information Technology Department.


text: Trustmark engages third party assessors, consultants and auditors in connection with its information security program, including to conduct external penetration testing, independent audits and risk assessments. Trustmark also utilizes third party service providers in the ordinary course of business. The Information Security Department performs information security assessments for third party service providers that store or process Trustmark confidential data. These information security assessments include a review of any systems and organization control reports, proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes and third party data protection controls (which can include, but is not limited to: access reviews and controls, backups, monitoring, encryption standards and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.


text: As a regulated financial institution, Trustmark is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation – Financial Privacy Laws and Cybersecurity" included in Part I. Item 1 – Business of this report.


text: Although Trustmark has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that Trustmark will not experience such an incident in the future. For additional information regarding the risk Trustmark faces from cybersecurity threats, please see the risk factors titled "Trustmark may experience disruptions of its operating systems or breaches in its information system security" and "Trustmark must utilize new technologies to deliver its products and services, which could require significant resources and expose Trustmark to additional risks, including cyber-security risks" included in Part I. Item 1A. – Risk Factors of this report.


text: Cybersecurity risk management is an integral part of our enterprise risk management program. Our cybersecurity program is designed to align with industry best practices and provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers.

companyName: American Well Corp

ticker: AMWL


text: Our Board has overall oversight responsibility for our risk management and is briefed periodically on cybersecurity risk management and any material cybersecurity incidents by our Chief Information Officer, or CIO, and General Counsel. The Board is responsible for ensuring that management has processes in place designed to (i) identify and evaluate cybersecurity risks to which the company is exposed and (ii) manage cybersecurity risks and mitigate cybersecurity incidents.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Specifically, our Security Steering Committee ("SSC"), a cross-functional team of employees chaired by our CIO, is responsible for providing strategic guidance and execution oversight to Amwell's privacy, risk and security programs and policies. Management has instituted an Information Security Management System ("ISMS"). The ISMS establishes risk-based safeguards that are designed to adequately protect the Company and information acquired through business operations. Amwell maintains its ISMS in accordance with ISO 27001 standards. Amwell is audited annually by a third-party assessment firm that determines the effectiveness of the procedures and processes of its ISMS. Amwell also self-assesses the performance and effectiveness of the ISMS through monitoring, measurement, analysis, and evaluation of controls and control objectives. The SSC ensures the workforce complies with the ISMS policies, procedures and controls through many channels, including annual review of audit and risk assessment results, multifactor authentication, annual employee training and company-wide communications.


text: Our team of cybersecurity focused employees, under the direction of our CIO, is responsible for assessing our cybersecurity risk and detecting, mitigating and remediating cybersecurity incidents. Our CIO and dedicated personnel are certified and experienced information systems security professionals and information security managers. Personnel with significant security responsibilities receive specialized education and training on their roles and responsibilities prior to being granted access to systems and resources. The pre-employment process for these roles is designed to ensure that security responsibilities are specifically defined. Our CIO has over 25 years of technology leadership experience.


text: Amwell's cybersecurity team has implemented processes to: • assess the severity of a cybersecurity threat through continuous monitoring and determine the nature, scope and timing of the event to assess whether it is material; • identify the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, utilizing our Information Security Incident Response Plan; • implement cybersecurity countermeasures and mitigation strategies; • and inform our board of directors of material cybersecurity threats and incidents.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Our Business and Industry" and "Risk Factors – Risks Related to Government Regulation" in this annual report on Form 10-K.


text: We are increasingly dependent upon information technology systems, infrastructure and data to operate our business. These systems are connected to and/or accessed from the Internet and, as a result, are susceptible to cyber-attacks. In the ordinary course of business, we collect, store and transmit confidential information (including but not limited to intellectual property, proprietary business information and personal information). It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. A material cyber-attack on our systems, or any other third-party partners or vendors and their key operating systems, may interrupt our ability to operate our business, damage our reputation, or result in monetary damages.

companyName: Prelude Therapeutics Inc

ticker: PRLD


text: Prelude has established an Information Security Policy ("IS Policy") in order to establish the high-level direction for properly managing the use, privacy, security, retention, and disposal of Prelude's information and its assets. The IS Policy was prepared using relevant guidance issued and technology standards that are used across various industries. The IS policy applies to all entities who are using Prelude's equipment and resources, including but not limited to: employees, contractors, temporary workers, any third parties with access to the Prelude's resources, and cloud IT providers. Prelude's Head of Information Technology ("IT") also serves as our Information Security Officer and is primarily responsible for implementing and overseeing the IS Policy and identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.


text: Prelude has also established an Incident Response Policy which includes reporting thresholds and follows standardized identification and authentication practices. If an incident is identified, it is documented by Prelude's Head of IT, who in turn, will report the incident to necessary management members.


text: Board Governance and Management Prelude's Information Security Officer provides updates on information technology risks, controls and procedure, including Prelude's plans to mitigate cybersecurity risks and respond to data breaches to Prelude's executive leadership team. Our Information Security Officer has over 20 years of experience in information security and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The Chief Financial Officer and the Chief Legal Officer report to the Chair of the Audit Committee prompt and timely information regarding any significant cybersecurity incident. The significant incident will be reported to the remaining Audit Committee members, as well as ongoing updates regarding any such incident until it has been addressed. Such incidents, as warranted, will be reviewed by the Board of Directors.


text: The Board of Directors has delegated responsibility for cybersecurity risk oversight to the Audit Committee, which is responsible for (i) regularly reviewing with management significant cybersecurity, privacy, and IT risks or exposures, and the Company's policies and processes with respect to risk assessment and risk management of the same; (ii) regularly reviewing with management an assessment of the steps management has taken to monitor and control such risks; and (iii) regularly reporting to the full Board of Directors on such matters. The Chair of the Audit Committee has expertise in risk management which includes IT and cybersecurity.


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: The Company has developed an information security program to address material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. Risk-based analysis and judgment, along with a recognized security framework, are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: Cinemark Holdings, Inc.

ticker: CNK


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services, as well as a security operations center. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.


text: The Company has a written incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo security awareness training when hired and annually. The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Additionally, in Item 1A Risk Factors, under the heading of Risk Related to Information Security and Business Disruptions, forward-looking cybersecurity threats that could have a material impact on the Company are discussed. Those sections of Item 1A Risk Factors should be read in conjunction with this Item 1C Cybersecurity.


text: The Chief Technology Officer (CTO) is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The Company's CTO, Doug Fay, has served as the Chief Technology Officer & Sr. Vice President for Cinemark since August 2006. Mr. Fay has a background in software engineering and application architecture and has worked in the information technology field since the early 1990s. The CTO routinely reviews risks and security measures and meets monthly with the general counsel, CFO, and Global Controller to review security measures and risks. Oversight of the information security program at the Board level sits with Audit Committee. Presentations regarding security measures and risks to the Audit Committee occur semi-annually. The Company's incident response plan defines the process for escalating incidents based on level of severity to the management team and Audit Committee.


text: The Company's Board and management recognize the importance of maintaining the trust and confidence of our customers, clients, business partners and employees, and that effective risk oversight is critical in running a successful business and fulfilling its fiduciary responsibilities to the company and its shareholders. Our Board is responsible for assuring that an appropriate culture of risk management exists within the Company and for setting the right "tone at the top." The Board oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance shareholder value.

companyName: BADGER METER INC

ticker: BMI


text: A fundamental part of risk management is not only understanding the risks a company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for the Company. The involvement of the full Board in setting the Company's business strategy is a key part of its assessment of management's tolerance for risk and also a determination of what constitutes an appropriate level of risk for the Company.


text: Refer to Part I, Item 1A. "Risk Factors" of this 2023 Annual Report on Form 10-K for further information about the Company's overall ERM process.


text: Cybersecurity is a critical component of the Company's ERM program. The Company has established an information security framework to help safeguard the confidentiality, integrity, and availability of information assets and ensure regulatory, operational, and contractual requirements are fulfilled. The Company's cybersecurity program is focused on the following key areas:


text: The Board provides oversight of the ERM process and reviews the significant identified risks. The Board's oversight of cybersecurity risk management is supported by the Audit and Compliance Committee, which regularly interacts with the Company's senior management, including the Director - Information Systems (i.e. the Company's chief information officer). The Company's various Board committees also play a role in risk management, as detailed in their respective charters.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the materiality, public disclosure and reporting of such incidents can be made by management in a timely manner. Senior leadership also briefs the Board on information security matters at least annually.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, such as machine learning intelligence platforms with an array of technologies, extensive encryption, firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The frameworks used to guide the deployment of technical safeguards include: International Organization for Standardization (ISO) 27001, Service Organization Control 2 (SOC 2), Sarbanes Oxley (SOX), and National Institute of Standards and Technology (NIST). The Company has been ISO 27001 certified since 2015 and is externally audited and certified annually by a leading IT compliance attestation firm.


text: Incident Response Planning: The Company has established, maintains and regularly tests incident response plans that address the Company's overall preparedness and response to a cybersecurity incident. The plans include, among other steps, assessment processes to determine the magnitude and materiality of an incident, an analysis of the need and method to communicate to various constituencies (customers, employees, authorities, etc.), and the requirements for public and regulatory disclosure. In addition to this response planning framework, among other mitigating actions the Company maintains an insurance policy for cybersecurity liability that provides not only coverage for breaches, but also loss prevention services and claims advisors.


text: Third Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third party systems. Third parties are granted access to systems based on the principle of least privilege.


text: The Company provides mandatory annual training for personnel regarding cybersecurity threats to educate employees with effective tools and knowledge to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. Quarterly internal phishing tests are performed, and periodic and/or thematic email communications are provided throughout the year to raise awareness. Individual training is given to personnel as needed.


text: The Board oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board receives annual cybersecurity updates from senior management, and the Audit and Compliance Committee provides a deeper level of oversight through an annual review to management's approach to cybersecurity risk with the Director – Information Systems. The Board and the Audit and Compliance Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Director – Information Systems, in coordination with management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. Management is actively involved in the incident response and risk management process (mitigation, transference, and acceptance).


text: IT Management and General Counsel are explicitly informed by the internal security team and Managed Security Service Provider (MSSP) of incidents and periodically updated on the investigation progress and impact of the incident. Management also receives explicit monthly summaries on all incidents. Major incidents are reported to company management and summarized at an annual management review meeting.


text: Internal IT Management has the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), GIAC/SANS Certified Forensic Examiner, Magnet Certified Forensic Examiner, BBA Information Technology Emphasis Security, and CompTIA Security+.


text: While the Company has experienced, and expects to continue to experience, cyber threats, no material security breaches of third-party information have occurred. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors" under the heading "General," which should be read in conjunction with the foregoing information.


text: The Company employs a tiered structure of management and oversight for cybersecurity, characterized by distinct layers of responsibility and decision making, which includes operation staff, management, and senior management and board-level governance. As discussed in more detail below under "Cybersecurity Governance", this involves management responsibility through a specialized Cyber Risk Committee (the "CRC") and oversight of that committee by a group of the most senior leaders of the Company, which comprise the Company's Executive Committee. At the Company's Board of Directors (the "Board") level, the Audit Committee oversees our cybersecurity risk management program.

companyName: REGENCY CENTERS LP


text: Our strategy for managing cybersecurity risk is integrated into the Company's overall risk management program and structure, as depicted in the Corporate Governance section of our Proxy under "Risk Oversight".


text: The Company, through its Chief Information Security Officer ("CISO"), other Company employees experienced in information network security, and the use of third-party expertise, references various recognized cybersecurity frameworks. These frameworks are used to benchmark and tailor the Company's cybersecurity strategies and program to our risk profile and specific operational needs and goals. Our core cybersecurity strategy focuses on five key pillars: identification, protection, detection, response, and recovery, each tailored to meet the specific challenges and needs of our business. The primary goal of this strategy is to proactively safeguard the confidentiality, security, and availability of the information we collect and store. This proactive approach includes identifying, preventing, and mitigating cybersecurity threats, as well as preparing to respond to cybersecurity incidents quickly and efficiently to minimize their impact. Under the leadership of our CISO and CRC, we are committed to a continuous evaluation and enhancement of our cybersecurity practices to facilitate adaptation to the constantly evolving landscape of cybersecurity threats.


text: We have adopted a risk-based strategy to manage cybersecurity risks associated with third parties. We prioritize our cybersecurity efforts relating to third parties based on the likelihood and potential impact of cybersecurity threats. This includes reviewing the security protocols of key vendors, service providers, and external users of our systems.


text: The CRC engages third-party expertise from time to time as it deems necessary or appropriate to test our cybersecurity defenses, to evaluate the cybersecurity programs of current and potential vendors and service providers, and to seek specialized legal advice regarding cybersecurity.


text: Since at least January 1, 2021, we are not aware of any cybersecurity incidents that have materially affected the Company. Based on our current understanding of the cyber risk environment and our preparedness level, we do not believe it to be reasonably likely in the near term that a cybersecurity threat will materially impact our business strategy, results of operations or financial condition.


text: The Audit Committee of the Board is charged with overseeing our cybersecurity risk management program. The CRC Chair and the CISO provide the Audit Committee with quarterly updates. These updates cover the overall status of the Company's cybersecurity program, as well as developments and potential new risks and trends. In the event of a significant cybersecurity threat or incident, the CRC would escalate communication frequency and intensity with the Audit Committee, Board, and the Company's Executive Committee (discussed below).


text: As designated by the Company's Executive Committee and the Audit Committee, our CRC leads Regency's cybersecurity risk management program. This includes risk identification, assessment, management, prevention and mitigation, as well as securing necessary resources and reporting on cybersecurity preparedness to the Executive Committee (which is currently comprised of the CEO, CFO, and several of the Company's other senior leaders) and the Audit Committee.


text: CRC membership, which is subject to change from time to time, includes management leadership possessing a diverse range of education, experience and expertise, and is currently comprised of Company's CISO, chief accounting officer, head of internal audit, general counsel and chief compliance officer, head of litigation, head of human resources, head of IT operations and the manager of network security. The collective experience of this committee encompasses areas such as IT, network security, change and incident management, public company governance, accounting, financial controls, insurance, risk management, communications, human capital, and legal matters including securities, privacy and technology contracting.


text: We are committed to protecting our information assets and systems from cybersecurity threats and ensuring compliance with applicable laws and regulations. Despite our commitment to protecting our systems, data and assets, we know that networks and systems are subject to the risk of an extended interruption, outage, or security incident due to many factors including, without limitation: (i) changes to our systems and networks for such things as scheduled maintenance and technology upgrades, or conversions to other technologies, service providers, or physical location of hardware; (ii) failures or lack of continuity of services from public cloud or third-party data center and other service providers; (iii) defects and/or critical security vulnerabilities in software programs; (iv) human and machine error; (v) acts of war and/or nature; (vi) intentional, unauthorized attacks from computer "hackers" or other cybersecurity attacks; and (vii) using the systems to perpetrate identity theft through unauthorized authentication to our customers' customers' accounts. In the following sections we describe how we identify, assess, and manage material risks related to cybersecurity, and how our Board of Directors (the "Board") oversees our cybersecurity program.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: We believe we have implemented a cybersecurity program that is aligned with the ISO 27001 framework, SEC regulations, and industry best practices. It is our goal to identify and manage material risks related to cybersecurity and implement effective controls and measures to mitigate such risks. The Board endeavors to provide effective oversight and governance of our cybersecurity program and ensure that our cybersecurity program supports our strategic objectives and risk appetite.


text: Although we take reasonable and effective measures to ensure the protection of any data that is stored, processed, or transmitted through our systems, we know that attackers have the means, motives, and opportunities to attack. As of the date of this filing we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. In addition, we maintain controls and procedures that are designed to ensure prompt escalation of critical cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner. Please refer to "Item 1A. Risk Factors" for further information about the material risks associated with various cybersecurity threats.


text: Our cybersecurity risk management process is aligned with our enterprise risk program. We continuously identify, assess, treat, and monitor cybersecurity risks and report those risks on a periodic and as-needed basis to executive management and the Board. We use various sources of information, including internal and external audits, tabletop exercises, threat intelligence, vulnerability scans, penetration tests, customer and employee feedback, and industry benchmarks, to identify and mitigate our cybersecurity risks. We will also engage third-party services, from time-to-time, to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Additionally, we evaluate trends in the legal and regulatory environment and consider business drivers, emerging threats, and technology changes to identify risks across our people, processes, and technology. We then assess our current controls and capabilities to mitigate those risks and develop action plans to address any identified gaps or weaknesses. Action plans are prioritized and implemented with monitoring of completion and effectiveness against the identified risks. We also monitor our performance and progress against various key indicators and objectives based upon ever-changing risks and provide ongoing updates to relevant stakeholders, including executive management and the Board.


text: We leverage the ISO 27001 framework for cybersecurity risk management. Our cybersecurity risk management strategy is frequently reviewed and adapted to address and meet current and emerging threats. Risk treatment plans are strategically prioritized and executed, and residual risks are reported through our enterprise risk program and elevated to executive management and the Board.


text: Our cross-functional Information Security Steering Committee ("ISSC") is the senior management team that oversees the direction, execution, and effectiveness of our cybersecurity program, policies and procedures including: cyber risks, mitigations, risk treatment plans, incident response plans, compliance with applicable regulations, and ensuring business-aligned cybersecurity objectives. The ISSC is chaired by our Chief Information Security Officer ("CISO") and consists of representatives from risk, compliance, internal audit, IT, accounting, finance, legal, and other key executives, including our Chief Information Officer ("CIO") and Chief Financial Officer. The ISSC meets quarterly to guide, direct, and monitor the performance and effectiveness of our cybersecurity program and elevates risks and mitigation plans, as appropriate, to the Board.


text: Overall Risk Approach The Board is responsible for oversight of our risks, including establishing our risk appetite and overseeing our risk management framework. The Board recognizes that effective risk oversight is important to the success of our strategy and is an integral part of exercising its fiduciary duties with respect to the Company and our stockholders. The Board believes our current leadership structure facilitates its oversight of risk by combining independent leadership through the Board with executive management members who have an intimate knowledge of our business, industry, and challenges.


text: Cybersecurity Risk Management and Oversight The Board is responsible for overseeing the Company's cybersecurity program and ensuring that it is aligned with our strategic goals and risk appetite. The Board has diverse expertise on topics including accounting and financial management, corporate governance, global business, technology and innovation, human capital management, ESG and cybersecurity. The Board also reviews the strategic direction of the Company's cybersecurity program and ensures that adequate resources and budget are allocated to address cybersecurity threats.


text: The Board exercises its cyber risk oversight primarily through executive management, our CIO and our CISO. Our CIO and CISO have expertise in the areas of information security and cybersecurity, through decades of management, prominent cybersecurity training, and real-world experience. Intimate knowledge of best practices, incident response, technologies, and IT and business processes enable the management team to be effective in their approach.


text: The Board also has a standing committee (the "Cybersecurity Committee") that advises it on cybersecurity matters and provides strategic guidance and direction for our cybersecurity program. The Cybersecurity Committee convenes as necessary to address critical or emerging cybersecurity concerns and to ensure alignment on approach. Our CIO and CISO collaborate with the Cybersecurity Committee and report to the entire Board on a quarterly basis, or more frequently as needed. Additionally, the Cybersecurity Committee reviews the outcomes of our regular tabletop exercises with our CIO and CISO and ensures that lessons learned have been incorporated into the overall strategy.


text: The Company's corporate information technology, communication networks, and accounting and financial reporting platforms are necessary for the operation of its business. The Company uses these systems, along with others, to manage its tenant and vendor relationships, for internal and external communications and for accounting to operate recordkeeping and reporting functions. The Company has implemented and maintains various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including confidential information.

companyName: CAPITAL PROPERTIES INC /RI/

ticker: CPTP


text: Management works primarily with third parties (principally professional services and consulting firms) that assist management in identifying, assessing, and managing cybersecurity risks. To operate its business, the Company utilizes certain third-party service providers to perform a variety of functions and seeks to engage reliable, reputable service providers that maintain cybersecurity programs. The Company is not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect it, including its business strategy, results of operations, or financial condition.


text: The Board of Directors oversees the Company's strategy and risk management, including material risks related to cybersecurity threats. The Board has delegated to the Audit Committee oversight of cybersecurity matters.


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. The Treasurer has primary oversight of material risks from cybersecurity threats and works primarily with third parties to identify, assess, and manage cybersecurity risks. The Treasurer meets with the Audit Committee periodically to review the Company's information technology systems and discuss key cybersecurity risks.