text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems and infrastructure. For more information, please see Item 1A - Risk Factors.


text: Related to Cybersecurity Risks Our Head of Information Technology, or IT, under the oversight of our Chief Legal Officer, is responsible for the administration and maintenance of our cybersecurity risk management program, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who currently holds the title of Head of IT has more than 20 years of experience in information security and cybersecurity risk management.

companyName: Disc Medicine, Inc.

ticker: IRON

secItem: Item 1C


text: Our Head of IT directly reports to, and meets periodically with, our Chief Legal Officer to discuss and review our cybersecurity risk management processes, with input from the Company's MSP and vCISO, as appropriate.


text: Our board of directors has delegated oversight of the Company's cybersecurity program to the audit committee of the board of directors. As provided in the audit committee charter, the audit committee is responsible for reviewing and discussing the Company's information security and risk management programs, controls, and procedures, including high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential breaches. Under the audit committee charter, the audit committee is also responsible for reviewing the recovery and communication plans for any unplanned outage, cybersecurity incident, or data breach.


text: Our Head of IT, twice a year, provides reports to the audit committee on the status of our cybersecurity program, including measures implemented to monitor and address risks from cybersecurity threats, as appropriate. He also reports on a quarterly basis to the executive committee on cybersecurity and information technology matters. The chair of the audit committee provides periodic reports on cybersecurity risk management to the full board of directors. Our Chief Legal Officer, on an annual basis, discusses the results of our enterprise risk assessment processes, including risks related to cybersecurity, with the full board of directors.


text: In an effort to reduce the likelihood and severity of cyber intrusions, Dominion Energy has a comprehensive cybersecurity program covering its operations, including DESC, designed to protect and preserve the confidentiality, integrity and availability of data and systems. Consideration of cybersecurity risks is a key component of Dominion Energy's overall risk management and integrated into processes such as evaluation of potential new vendors or suppliers. Dominion Energy is subject to mandatory cybersecurity regulatory requirements, interface regularly with a wide range of external organizations and participate in classified briefings to maintain an awareness of current cybersecurity threats and vulnerabilities.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: Dominion Energy's corporate intelligence and security program includes both cybersecurity and threat intelligence components as part of its evaluation and mitigation of risks. The evaluation of risks includes consideration of cybersecurity and privacy risk, including potential impact on Dominion Energy's employees, customers, supply chain and other stakeholders, intelligence briefings on notable cyber events impacting the industry and evaluation of insider threats. Dominion Energy utilizes a robust set of internal and third-party assessment tools to test its cyber risk management policies, practices and procedures as well as challenge assumptions upon which its defenses are built. These assessments provide opportunities for self-critical analysis and constructive feedback needed to build cyber resilience. Trainings are routinely provided to employees to help identify, avoid and mitigate cybersecurity threats and to ensure an understanding of Dominion Energy's cyber risk management policies. In addition, risk assessments are conducted as a component of the evaluation of vendors and suppliers.


text: Dominion Energy's current security posture and regulatory compliance efforts are intended to address the evolving and changing cyber threats. During the past three years, DESC has no t experienced any cybersecurity incidents resulting in a material impact to their business strategy, results of operations or financial condition. DESC has identified the risk that a hostile cyber intrusion could severely impair DESC's operations, lead to disclosure of confidential information, damage Dominion Energy's reputation or otherwise have an adverse effect on DESC's business as disclosed under the Operational Risks header within Item 1A. Risk Factors.


text: Dominion Energy's Board of Directors, including its operations committee (effective in July 2024, previously its finance and risk oversight committee), provides oversight of risks from cybersecurity threats to all Dominion Energy operations, including DESC. Dominion Energy's Board of Directors as well as its operations committee (effective in July 2024, previously its finance and risk oversight committee) receive presentations and reports throughout the year on cybersecurity and information security risk from management, including Dominion Energy's chief security officer, director of cybersecurity (CISO) and chief information officer. These presentations and reports address a broad range of topics, including Dominion Energy's cyber risk management program, updates on recent cybersecurity threats and incidents across the industry, policies and practices, industry trends, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external critical threats, including management's hosting in 2024 of its third practical exercise with external federal, state and local incident response partners. In addition, Dominion Energy's Board of Directors receives briefings from time to time from outside experts for an independent view on cybersecurity risks, including assessments by independent consulting firms and legal counsel of the Company's readiness and resilience.


text: Dominion Energy utilizes an organization structure known as a converged security model that brings together cybersecurity, physical security and threat intelligence within one department led by the chief security officer. The chief security officer joined Dominion Energy in this role in 2018 and has an extensive background in security having retired from the Federal Bureau of Investigation after a more than 20-year career focused on criminal, counter-terrorism, counter-intelligence and cyber investigations. The chief security officer belongs to the Federal Bureau of Investigation's Domestic Security Alliance Council, the Department of Homeland Security's Classified Intelligence Forum and is a member of the national Government/Business Executive Forum. In addition to serving on multiple university advisory boards, the chief security officer also serves on the Commonwealth of Virginia's Informational Technology Advisory Council.


text: The director of cybersecurity (CISO) has over 30 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management, as well as cybersecurity. The director of cybersecurity (CISO) has been involved in designing and evolving Dominion Energy's cyber risk management policies, practices and procedures. This individual has deep relationships with key external partners and is recognized within the industry and the U.S. as a leading cybersecurity expert.


text: In addition, management of cybersecurity threats is shared with the chief information officer who is responsible for Dominion Energy's technology assets including hardware, software, networks, servers and telecommunications. The chief information officer has over 25 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management. In addition, the chief information officer previously served on the board of the Virginia Cybersecurity Partnership, a collaboration between private industry and the Federal Bureau of Investigation.


text: The chief security officer and chief information officer are supported by the senior vice president of administrative services as well as Dominion Energy's operations, compliance, legal, audit, corporate risk, supply chain, human resources and accounting departments in executing its cybersecurity program. In addition, the chief security officer and chief information officer provide periodic updates concerning recent developments affecting cybersecurity and privacy risk to Dominion Energy's executive cyber risk council, which includes executive officers responsible for administrative services, corporate affairs, supply chain, corporate secretary and corporate risk along with legal counsel.


text: Dominion Energy maintains a robust, tested and regularly revised Cyber Security Incident Response Plan and a Vendor Compromise Response Plan. These plans detail roles, responsibilities, and actions to be taken in response to a detected event whether internal or associated with a third-party service provider. The plans provide clear direction for escalation of information to leadership, including Dominion Energy's Board of Directors as appropriate, and drive collaboration amongst relevant members of management representing cybersecurity, information technology, operations, supply chain, legal and accounting departments. As necessary, the COO, CFO and chief legal officer will advise the CEO on any incidents which could potentially have a material effect on Dominion Energy's business operations, results of operations or financial condition.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our security approach is aligned with applicable security and/or technical requirements and best practices established by National Institute of Standards and Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that our information security team uses the NIST CSF as the framework for helping us to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Endeavor Group Holdings, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and is designed to share common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. We have a cross-functional team composed of senior IT, cybersecurity and compliance leadership that typically meets on a monthly basis to discuss efforts to identify new or prospective risks, mitigate previously identified risks, and discuss recent cybersecurity events. This cross-functional team reports into an executive steering committee comprised of senior enterprise leadership which meets, at a minimum, quarterly.


text: We use a defense-in-depth strategy across our business applications and systems, including database encryption, encryption for laptops/desktops, endpoint-security solutions including network filtering, anti-virus, endpoint firewalls, endpoint detection/response, patch and security configuration management and monitoring through our use of a Security Information and Event Management ("SIEM") system. The SIEM is monitored by our Security Operations Center ("SOC"). Our network and applications require multi-factor authentication, and logins are monitored for unusual activity by our SOC function. The enterprise network is protected by stateful firewalls, which are also monitored via our SOC. Our dedicated cybersecurity team engages third parties to conduct periodic infrastructure, application, compliance, and security operations testing, and threats/findings are managed through our risk-register and governance processes.


text: Separately, employees are trained to promptly report any suspicious behavior or events to the Company's Core Security Incident Response team. This team includes IT, cybersecurity, compliance, and risk management team members. The core team oversees the investigation and handling of all reported incidents (which incidents are tracked in real time). If the core team determines that the reported event could potentially impact personally identifiable information processed by the Company, confidential/proprietary information or cause a financial loss, the core team reports the matter to Endeavor's Cybersecurity Executive Steering Committee, which includes Endeavor's Chief Administrative Officer, General Counsel, Chief Financial Officer, Chief Accounting Officer, Chief Compliance Officer, Chief Information Officer, Corporate Communications, Corporate Secretary, Senior Vice President ("SVP"), Internal Audit, SVP, Privacy & Cybersecurity, SVP, Cybersecurity, and SVP, Head of Corporate Security. Reported events that may cause a financial loss are also reported to the legal department's fraud investigation team. The Cybersecurity Executive Steering Committee is charged with managing the Core Security Incident Response Team and determining whether any disclosures may be required as a result of the reported event.


text: Our cybersecurity risk management program, thus, includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; a written cybersecurity incident response plan;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management not less often than once per calendar year;


text: phishing simulations at regular intervals (not less than quarterly) to all users of the company's email system; and a third-party risk management process for service providers, suppliers, and vendors which connect to our IT systems or process data on our behalf. This risk management process is designed to review the cybersecurity protocols, policies and preparedness of any vendor that processes personally identifiable information for the company or the company's confidential or proprietary information or otherwise is connected to any company IT infrastructure before entering an agreement with such vendor and/or at least every 18 months thereafter. Such reviews consist of reviewing SOC2 Type II reports for vendors which maintain them or, for those that don't, a review of the vendor's responses to a detailed questionnaire. Upon a review of such responses, the Company's cybersecurity team may propose contractual remediation obligations to be agreed upon by the vendor.


text: Our continually evolving cybersecurity strategies are informed by multiple threat intelligence resources, the status of ongoing remediation plans, and technical developments. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – Risks Related to Our Business — Failure to protect our IT Systems and Confidential Information against breakdowns, security breaches, and other cybersecurity risks could result in financial penalties, legal liability, and/or reputational harm, which would adversely affect our business, results of operations, and financial condition."


text: Our Board, including the Governing Body, considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Audit Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser impact potential. The Audit Committee members also receive presentations on cybersecurity topics from our Chief Compliance Officer, Chief Information Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The full Board and the Governing Body receive regular updates regarding the Audit Committee's activities.


text: Our management team, including our Chief Compliance Officer, Chief Information Officer, SVP, Privacy & Cybersecurity, and SVP, Cybersecurity, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Information Officer is responsible for implementation and enforcement of written information security policies. The Chief Information Officer has designated leaders, including the SVP, Cybersecurity, to be responsible for overall management of the information security management program, including developing and operating within the defined global information security controls to protect our IT systems, selecting and supervising retained cybersecurity consultants, and working with Legal, Compliance, and Human Resources personnel to develop and launch appropriate information security training of our workforce. Our management team has decades of experience leading and managing cybersecurity teams as well as professional credentials in cybersecurity and data privacy. Our SVP, Privacy & Cybersecurity, leads a team of five dedicated privacy professionals in the Legal department.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Nucor recognizes the importance of developing, implementing, and maintaining effective cybersecurity measures designed to protect our information systems and the confidentiality, integrity, and availability of our data. We face a number of information technology and cybersecurity threats which could have an adverse effect on our business and results of operations.

companyName: NUCOR CORP

ticker: NUE


text: Notwithstanding the Company's cybersecurity framework and preventative strategies, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.


text: We have developed and implemented a cybersecurity risk management program that is intended to enable us to assess, identify, and manage risk associated with cybersecurity threats. Our program is based on the Cybersecurity Framework promulgated by the National Institute of Standards and Technology and other applicable industry standards, and includes the following key elements: • identification and assessment of cybersecurity threats based on internal and external assessments and monitoring, information from internal stakeholders, and external publications and resources such as those made available by the United States Cybersecurity and Infrastructure Security Agency; • technical and organizational safeguards designed to protect against identified threats, including documented policies and procedures, technical controls, and employee education and awareness; • processes to detect the occurrence of cybersecurity events, and maintenance and regular testing of incident response and recovery and business continuity plans and processes; and • a third-party risk management process to manage cybersecurity risks associated with our service providers, suppliers, and vendors. The program is designed to foster a culture of cybersecurity risk management across the Company.


text: Integrated Overall Risk Management Assessing, identifying, and managing cybersecurity-related risks is integrated into our overall risk management framework. The Company conducts an annual cybersecurity risk assessment and reports the most significant risks and associated planned mitigation strategies to the Audit Committee of the Board of Directors. The annual risk assessment is carried out under the supervision of the Executive Vice President of Business Services and General Counsel, the President of Nucor Business Technology, the Company's Cybersecurity Director, and the Company's Vice President and Corporate Controller. See "Governance" below. The Board also regularly receives focused presentations regarding cybersecurity risks from the Company's Cybersecurity Director.


text: Third-Party Engagement Due to the complexity and ever-changing nature of cybersecurity threats, Nucor engages a range of external experts to assist in its assessment, identification, and management of risks from cybersecurity threats. These include cybersecurity assessors, forensic and incident response experts, and auditors to review the Company's cybersecurity posture and responsive efforts. Our relationships with these external partners enable us to leverage their expertise with the goal of maintaining best practices.


text: Oversight of Third-Party Risks Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact Nucor in certain circumstances. In response, we have implemented processes for overseeing and managing these risks. Those processes include limiting the exposure of our information systems to external systems to the least practicable amount, assessing the third parties' information security practices before allowing them to access our information systems or data, requiring the third parties to implement appropriate cybersecurity controls in our agreements with them, and conducting ongoing monitoring of their compliance with those requirements. We also utilize third-party risk and compliance monitoring services to monitor our service providers, suppliers, and vendors and to augment the effectiveness of our risk mitigation efforts in this area.


text: Risks from Cybersecurity Threats As of the date of this report, no risks from cybersecurity threats, including as a result of cybersecurity incidents we have experienced in the past, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. The Company seeks to ensure effective governance in managing risks associated with cybersecurity threats, as more thoroughly described below.


text: The Audit Committee of the Board of Directors is responsible for the oversight of risks from cybersecurity threats. The Audit Committee is composed of directors with a wide range of experience, including risk management and controls, and technology. See "Integrated Overall Risk Management" above.


text: Management's Role in Cybersecurity Risk Management A division of the Company known as Nucor Business Technology, or NBT, is responsible for the Company's information technology needs, including cybersecurity risk assessment and management. NBT's cybersecurity function is led by the Cybersecurity Director, who reports to the President of NBT, who in turn reports to the Company's Executive Vice President of Business Services and General Counsel and to the Chair, President, and Chief Executive Officer. The current Cybersecurity Director has more than twenty years of experience in the cybersecurity field and has broad expertise in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, and incident response.


text: The Company also has a Risk Committee composed of the following members of the Company's management: • Executive Vice President of Business Services & General Counsel • President, Nucor Business Technology • Vice President and Corporate Controller • Vice President and General Manager, Corporate Legal Affairs • General Manager of Internal Audit • Cybersecurity Director • Director of Legal Compliance and Assistant Corporate Secretary • Manager of External Reporting The Risk Committee is responsible for overseeing the Company's response to cybersecurity incidents. The Risk Committee and the Chair, President, and Chief Executive Officer inform the Audit Committee and the Board of Directors on cybersecurity risks.


text: Monitoring of Cybersecurity Incidents The Cybersecurity Director implements and oversees our processes for regularly monitoring our information systems. This includes security measures and regular audits to identify potential issues. In the event of a cybersecurity incident, we have an established incident response plan that requires prompt notification of the Cybersecurity Director or their designee, who in turn oversees our assessment of and response to the incident. The Cybersecurity Director is also responsible for informing the Risk Committee of cybersecurity incidents, which in turn has a detailed process for assessing the impacts of incidents and monitoring the Company's mitigation and remediation efforts. Depending on the nature of the incident, this process also provides for escalating notification to senior executives, including the Chair, President, and Chief Executive Officer, the Executive Vice President of Business Services and General Counsel and to the Board of Directors.


text: The Company maintains a cyber risk management program to prevent, detect and respond to information security threats. This program is supervised by a dedicated Chief Information Security Officer (CISO) whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The CISO manages the program in collaboration with the Company's businesses and functions. To mitigate the risk of cybersecurity threats and data breaches we also have established policies and procedures, including a Cybersecurity & Data Breach Incident Response Policy and identified an Incident Response Team (IRT) with defined roles, responsibilities and means of communication. As part of our broader risk management and control framework we have implemented cybersecurity controls over the information technology and process control systems of the Company and of its third-party service providers. The Company engages third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer and vendor data as well as data affecting our process controls and data used to operate our manufacturing and converting facilities. We work with an independent assessor to conduct interim assessments and track ongoing efforts to continuously improve the Company's cyber risk management program. The most recent assessment was completed at the end of 2022. In addition, the Company utilizes an independent audit firm to perform specific attack and penetration reviews on an annual basis. While we have experienced threats to our data and systems, as of December 31, 2024, we are not aware of any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, our operations or financial condition.

companyName: PACKAGING CORP OF AMERICA

ticker: PKG


text: Board Roles and Responsibilities The Audit Committee of the Board of Directors oversees the Company's cyber risk management program. The Chief Information Officer (CIO) presents frequent updates to the Audit Committee and, as necessary, to the full Board of Directors. These regular reports include detailed updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. In addition, we have established processes to notify the Audit Committee of active incidents, as deemed necessary. The Company's program is periodically evaluated by third-party experts, and the results of those reviews are reported to the Board of Directors.


text: Management Responsibilities The Incident Response Team that we have established as part of our cyber risk management program coordinates the Company's response to incidents and communicates with internal and external stakeholders. The team includes members of our Senior Leadership and draws upon additional staff, consultants, advisors and service providers as needed.


text: We are continuously focused on ensuring our Company is protected from potential cyber threats. Our Information Technology (IT) team is comprised of employees with a diverse mix of skills, backgrounds, perspectives, and relevant expertise, that undergo extensive training as part of their employment with the Company. We believe these measures together with our cyber risk management program as well as our policies, processes and procedures set a high benchmark for our employees to address and respond to cybersecurity threats.


text: Our IT team regularly monitors best practices and as needed, implements changes to the Company's cyber risk management program to ensure a robust program is maintained. Aspects of this program include plans and procedures for identifying, communicating and containing security incidents, regular risk assessments and testing of the Company's internal infrastructure to identify vulnerabilities, procedures for recovering from disruptions to our operations, maintaining global security policies, and comprehensive end user training and cybersecurity drills for personnel.


text: We are committed to implementing all reasonable measures to ensure the confidentiality, integrity and availability of data that is owned and managed by us. We also endeavor to protect confidential information that is shared with us by our business partners. The cybersecurity program at Koppers has been designed based on an industry standard cybersecurity framework and is aligned with local and regional compliance requirements. The cybersecurity program is reviewed periodically by an independent third-party, and the results are shared with the board of directors. Components of the cybersecurity program are guided by the results of the independent third-party assessment. The cybersecurity program is part of the larger Enterprise Risk Management (ERM) program which is reviewed by management and the board of directors on a periodic basis. Compliance with the cybersecurity program is ensured via policies, procedures, training, and systems.

companyName: Koppers Holdings Inc.

ticker: KOP


text: Information security policies at Koppers lay out the guardrails that ensure compliance with the program. Examples of guardrails set within the information security policies at Koppers include, where appropriate, application of the principle of least privilege when granting access (the principle that a user or entity should only have access to the specific data, resources and applications needed to complete a required task), logging and monitoring activity of privileged accounts, authorized physical and logical access to information technology (IT) systems, and requiring maintenance of confidentiality of non-public information. Standard operating procedures (SOPs) help to ensure accuracy and completeness of various IT tasks being performed throughout the organization. SOPs include incorporating data processing agreements in contracts, commissioning and decommissioning of IT systems, granting role-based user access, patch management, and change management. Training is conducted regularly for all employees who interact with Koppers IT systems. Specialized training is also conducted for employees who deal with sensitive data. Security systems have been deployed to manage vulnerabilities within the IT environment, and periodic penetration tests validate the Koppers security posture.


text: IT systems are protected using various tools like multi-factor authentication (MFA), virtual private network (VPN), firewalls, end-point protection, spam and web filters, mobile device management, and privileged access management. A third-party monitoring service aids in detecting any threats or anomalies with the network. A multi-department incident response plan has been developed to facilitate a swift response in the event of a cybersecurity incident, which includes notifying the appropriate regulatory agencies. IT systems critical to the business operations have been identified and plans have been developed for a swift recovery of IT services in the event of a service failure. We conduct annual security reviews of all service providers that provide critical service to the business. A cybersecurity risk assessment is conducted prior to contracting with a new IT cloud service provider providing high-impact services.


text: The Strategy and Risk Committee of the board of directors is composed of board members with diverse experience that allows them to oversee cybersecurity risks effectively. We have a Vice President, Information Technology with over 20 years of experience at Koppers in various positions of increasing responsibility within the IT function, working on initiatives related to enterprise resource planning systems, mobile computing, data analytics, SOX compliance, and cybersecurity. Prior to working at Koppers, the Vice President, Information Technology worked at a global technology consulting company implementing software solutions. This position plays a pivotal role in informing management, the Strategy and Risk Committee and the board of directors on cybersecurity risks. An update on the cybersecurity program is provided to the board of directors quarterly. As of the date of this report, we have not experienced a material information security incident.


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. As a real estate company with hundreds of properties located across the United States, we guard against a multitude of cybersecurity risks that range from threats common to most industries, such as ransomware and denial-of-service, to threats from more advanced, persistent, or organized actors, including those acting on behalf of nation-states that target critical infrastructure sectors. Tenants, lenders, suppliers, subcontractors, and equity partners throughout the industry face similar cybersecurity risks, and a cybersecurity incident impacting us or a related entity could materially adversely affect operations, performance, or operating results. These and related risks make it imperative that we vigilantly tend to the social, physical, and logical aspects of our cybersecurity.

companyName: ExchangeRight Income Fund


text: Identifying, assessing, and mitigating cybersecurity and related risks are disciplines we integrate into our overall enterprise risk management ("ERM") process. Our ERM process and cybersecurity policies are based on the National Institute of Standards and Technology and Consensus Audit Guidelines. As part of our process, we complete continuous vulnerability scanning, end point detection and response, employee cybersecurity awareness training, and security monitoring. To the extent our ERM process identifies any relevant heightened cybersecurity related threat, we assign risk owners to develop mitigation plans, which we then track until full execution aligned with our Incident Response Plan.


text: The Company is committed to the ongoing development and implementation of stringent processes to oversee and manage the risks associated with third-party service providers. Our policy is to conduct thorough security assessments of key third-party service providers prior to engagement, and to ensure compliance with our cybersecurity standards. Monitoring includes quarterly security assessments and annual evaluation of security controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Notwithstanding our commitment to high standards for cybersecurity, we may not always be successful in preventing a potential cybersecurity incident that could have a material adverse effect. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.


text: Oversight by Key Principals The Key Principals are the sole managers of ExchangeRight, which is the sole member and manager of our Trustee, and, accordingly, act as the directors of the Company. The Key Principals oversee management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. The Key Principals are acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Key Principals are committed to effective governance in managing risks associated with cybersecurity in order to uphold operational integrity and stakeholder confidence.


text: Management's Role in Assessing and Managing Cybersecurity Risk ExchangeRight's Senior Information Technology and Enterprise Applications Manager leads our information security team, which is responsible for developing and executing our enterprise-wide cybersecurity strategy. With over 13 years of experience in information technology, security strategy, program management, and internal controls, our information security team brings extensive expertise in evaluating, implementing, and overseeing security initiatives that protect our organization from cyber threats.


text: The information security team's background includes information technology governance, risk management & compliance, security controls, and enterprise application security, ensuring our systems align with best practices and regulatory standards. As a control owner for Information Technology General Controls ("ITGCs"), they oversee security reviews, change management processes, and system integrity for critical applications, such as enterprise resource planning ("ERP") and enterprise software solutions. Additionally, they have played a key role in architecting and managing secure operational workflows, leading ERP implementations, and ensuring compliance with internal controls over financial reporting, pursuant to Section 302 of the Sarbanes-Oxley Act, and audit requirements.


text: Under their leadership, the information security team continuously strengthens our enterprise security posture, mitigating cyber risks while enhancing system resilience to minimize business disruptions. Recognizing that cybersecurity is a shared responsibility, they foster a corporate culture of security awareness and accountability, ensuring that employees beyond the security team remain vigilant against evolving cyber threats.


text: The Senior Information Technology and Enterprise Applications Manager notifies the Key Principals of our cybersecurity and information security posture as appropriate and the Key Principals are apprised of cybersecurity incidents deemed to have any relevant business impact. The Key Principals, Senior Information Technology and Enterprise Applications Manager, our Chief Financial Officer, Chief Accounting Officer, and our Executive Managing Principal maintain an open dialogue regarding emerging or potential cybersecurity risks. The Senior Information Technology and Enterprise Applications Manager keeps them appraised of updates on any significant developments in the cybersecurity domain, ensuring the Key Principals' oversight is both proactive and responsive.


text: The Senior Information Technology and Enterprise Applications Manager is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Senior Information Technology and Enterprise Applications Manager oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the information security team is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Key Management Personnel As disclosed above, the primary responsibility for our overall information security strategy and directive resides with our Senior Information Technology and Enterprise Applications Manager with reliance on our information security team. With over 50 years of cumulative experience in the field, ExchangeRight's information security team brings a wealth of expertise to our organization. The team includes individuals with backgrounds in Information Technology, Data Science, Enterprise Applications, and Business Development. Their in-depth knowledge and expertise are instrumental in developing and executing our cybersecurity strategies.


text: Risks from Cybersecurity Incidents To date, we have not encountered, to our knowledge, a cybersecurity incident that has materially impaired, or is reasonably likely to materially impair, our operations or financial condition. There can be no assurance that such effects may not occur in the future.


text: Cybersecurity Governance, Risk Management and Strategy In the current digital environment, companies like ours may be the target of cyber-attacks or other malicious efforts to cause a cyber incident. These cyber incidents can include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. The possible consequences of such an attack include but are not limited to loss of data, damage to our reputation, interruptions to our operations, and/or the need to pay ransom. Historically, we have not experienced cybersecurity incidents that materially impacted our business strategy, operating results and financial condition but we cannot guarantee a future cybersecurity incident would not materially impact us.

companyName: NEXSTAR MEDIA GROUP, INC.

ticker: NXST


text: We recognize the importance of maintaining the confidence and trust of our customers, suppliers, employees, audience, and communities by maintaining our data and information security. In managing our cyber risk, we utilize the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Framework") issued by the U.S. government as a guideline to manage our cybersecurity-related risk. In addition, we have established security control requirements for our third-party vendors based on global standards.


text: Our day-to-day cybersecurity efforts are led operationally by our Chief Technology and Digital Officer and Senior Vice President, Technology who have over 10 and 25 years, respectively, of networking and information technology management or executive experience, and oversee a team of in-house cybersecurity specialists. Our Cybersecurity Committee, comprised of representatives from key management groups including accounting, finance, legal, internal audit, and information technology, also supports our cybersecurity efforts. The Cybersecurity Committee consults with representatives from senior management and retains third-party contractors as needed. The role of the Cybersecurity Committee is to oversee cyber risk assessments, monitor applicable key risk indicators, review cybersecurity training procedures, establish cybersecurity policies and procedures, and implement enhancements to our cybersecurity infrastructure. The Cybersecurity Committee meets monthly, or more regularly as necessary, and ensures that senior management, and ultimately, the Board, is given the information required to manage and exercise proper oversight over cybersecurity risks and ensure that escalation procedures are followed in the event of a cybersecurity incident.


text: As part of its role as independent oversight of the key risks facing Nexstar, the Board itself and through its Audit Committee devotes regular and thorough attention to our cybersecurity risk. The Audit Committee receives quarterly (or more frequent as necessary) reports from senior financial executives and Nexstar's Chief Technology and Digital Officer to evaluate cybersecurity and data risks. Such reporting includes updates on the Company's cybersecurity program, the external threat environment, and the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat landscape. In accordance with our Cyber Incident Response Plan, the Audit Committee is promptly informed of any cybersecurity incidents that could potentially materially adversely affect the Company or its information systems and is regularly updated about incidents with lesser impact potential. The Audit Committee and management regularly brief the full Board on these matters as well.


text: For additional discussion of certain risks associated with cybersecurity, see Item 1A, "Risk Factors" under the heading "Cybersecurity risks could adversely affect our operating effectiveness and operating results."


text: We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. We are subject to numerous and evolving cybersecurity risks that could adversely and materially affect our business, financial conditions and results of operations.

companyName: Domtar CORP


text: We have implemented a cybersecurity risk management program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework to assess, identify and manage cybersecurity risk that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems.


text: Our program includes regular risk assessments, penetration testing performed by the internal team and independent third parties, patch management, and vulnerability scanning to identify potential threats and vulnerabilities. We have also implemented a robust security awareness program that includes regular phishing tests and requires employees to undergo annual security awareness training. Our cybersecurity strategy is focused on establishing the zero-trust security model to protect our information assets' confidentiality, integrity, and availability. We also have an incident response process and various incident response plans that are designed to provide timely and effective actions in the event of a cybersecurity incident. Our incident response plan includes procedures for determining the root cause and impacts of the incident, containment actions to mitigate the impacts, and notifying affected parties.


text: With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement.


text: Despite our efforts, we recognize that no system is completely secure, and our main material cybersecurity risks are related to ransomware attacks, phishing attacks, insider threats, and third-party attacks. We monitor our systems against these risks and adjust our cybersecurity strategy accordingly. Our IT systems have been, and will likely continue to be, subject to computer viruses or other malicious codes, unauthorized access attempts, phishing, and other cyber-incidents, none of which, to Domtar's knowledge, have had a material impact on its business information systems or operations. While we cannot guarantee that our security efforts will prevent breaches or breakdowns to our IT systems or those of our third-party providers, we have a robust disaster recovery process that is exercised annually. For more information about cybersecurity risks, see the Risk factors discussion in Item 1A of this Form 10-K.


text: Our Management Leadership Team reviews cybersecurity risks as part of their oversight and execution of the Company's business operations and strategy. The Company's Management Board, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company's strategy as well as emerging risks. We have established oversight mechanisms intended to provide effective cybersecurity governance, risk management, and timely incident response.


text: We believe cybersecurity is critical to advancing our technological developments. As a biopharmaceutical company, we face a multitude of cybersecurity threats common to most industries, such as ransomware and denial of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Cardiff Oncology, Inc.

ticker: CRDF


text: We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. We have established cybersecurity security awareness training and ongoing monitoring.


text: In the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to our IT Incident Response Coordinator who will investigate the direct impact of the incident. Once a potential incident has been confirmed, the Incident Response Coordinator will notify senior management that activation of the incident response plan is required and assign a severity rating, ranging from none to critical, based on the perceived impact.


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: Our Information Technology Lead is responsible for the strategic leadership and day-to-day management of our cybersecurity risk management program. The individual is working in that role for more than 10 years for the company. We also engaged with third-party IT service providers, who specialize in the field of cybersecurity risk management, for targeted employee training and system risk assessments.


text: While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.


text: The Company maintains a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The program is integrated within the Company's enterprise risk management framework and addresses both the corporate information technology environment and the external ecosystem.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: The underlying controls of the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology. The Company has a third party perform an annual assessment of the Company's cybersecurity risk management program. The Company has a Cyber Security Operations Center monitoring our global cybersecurity environment and coordinates investigations and remediation of alerts. We are enhancing our programs for staging incident response drills to prepare support teams for a significant incident. The cybersecurity risk management program includes administrative, physical, and technical controls.


text: Our VP, Head of Information Technology is the Company's designated Chief Information Security Officer (CISO) and is responsible for developing and implementing the cybersecurity risk management program, including and reporting on cybersecurity matters to the Board. The VP, Head of Information Technology has over twenty years of experience leading cybersecurity oversight. Additionally, members of the IT security team have cybersecurity experience and/or certifications, such as the Certified Information Systems Security Professional and Certified Information Systems Audit credential. The Company views cybersecurity as a shared responsibility across our management team and plans to periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity training at least once annually and have access to more frequent cybersecurity training through online and live events. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training that is documented in our quality management system. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.


text: Our Chief Information Security Officer is responsible for continuously monitoring and assessing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervising such efforts. The cybersecurity team collectively has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as information obtained from governmental, public, and private sources, including external consultants engaged by the Company on a real time basis. The Company is continuously enhancing its processes for oversight of third-party vendors, including appropriate due diligence for new providers and continuous monitoring, including ongoing direct contact with vendor personnel. Third-party vendors are re-evaluated at regular intervals as part of our supplier qualification process.


text: The Audit Committee, in addition to the Company's Chief Financial Officer, General Counsel and Chief Compliance Officer, oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee, Chief Financial Officer, General Counsel and Chief Compliance Officer on the effectiveness of the Company's cyber risk management program, generally on a quarterly basis. In addition, cybersecurity risks will be reviewed by the Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.


text: We have not experienced any material cybersecurity incidents to date, and, by default, we believe no cybersecurity events have occurred that have materially affected the Company or its business strategy, results of operations or financial condition. We continue to invest in cybersecurity and the resilience of our infrastructure and the enhancement of our internal controls and processes, which are designed to help protect our systems and data, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: LENSAR, Inc.

ticker: LNSR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers with subject matter expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business— We rely significantly on the use of information technology. Cybersecurity risks – any technology failures causing a material disruption to operational technology or cyber-attacks on our systems affecting our ability to protect the integrity and security of customer and employee information – could harm our reputation and/or could disrupt our operations and negatively impact our business."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal information technology staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the Director of Information Technology, Chief Operating Officer, Chief Financial Officer, and Principal Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team collectively has over 30 years of experience managing cybersecurity risks and is knowledgeable about our products and systems.


text: Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. To help the Company address these risks, we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework. Our cybersecurity risk management program is integrated within our enterprise risk management program.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: Our cybersecurity risk management program includes a number of components, including but not limited to a Cybersecurity Incident Response Plan ("CSIRP"), annual cybersecurity awareness training for our employees, security assessments, vendor risk management, regular system maintenance including application of security patches as appropriate, regular penetration testing and implementation of enhancements to security measures used to protect our systems and data. We employ third parties, including assessors, consultants and auditors, in our cyber risk management program as appropriate, e.g., training, assessment, auditing, benchmarking, and penetration testing.


text: Our CSIRP is designed to guide our incident response process for cybersecurity incidents that could affect our systems, network, or data. The CSIRP identifies the individuals responsible for developing, maintaining, and following appropriate procedures related to identified cybersecurity incidents, including a framework for identifying and addressing material cybersecurity incidents. We periodically test our CSIRP using tabletop exercises with the goal of improving our processes and preparedness.


text: Risks from cybersecurity threats have not to date materially affected us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, incidents or compromises, which could result in a disruption of our operations and development efforts" in Item 1A. Risk Factors.


text: The Board of Directors, as a whole and through its committees, has responsibility for the oversight of risk management, which includes ensuring that the risk management process implemented within our organization is appropriate and functioning as designed. The Audit Committee of our Board of Directors oversees cybersecurity risks pursuant to its charter, and our governance framework includes oversight by the Audit Committee. The Audit Committee, with assistance from our management, including our Head of Information Technology ("IT"), periodically reports to the full Board of Directors to inform them of potential cybersecurity risks and threats, the status of projects to further develop our information security systems, and the emerging cybersecurity threat landscape.


text: Our Head of IT has primary responsibility for day-to-day management of our cybersecurity risk management program, including leading a dedicated team of IT professionals to monitor and assess cybersecurity risks, and is responsible for strategic leadership of our cybersecurity risk management program. The Head of IT role is currently held by an individual who has close to twenty years of professional IT management experience in the life sciences industry. Our Head of IT also provides regular updates on our cybersecurity risk to our executive leadership team and other management committees responsible for IT and cybersecurity risk management. Under our CSIRP and other applicable policies and procedures, we have established a framework for responding to cybersecurity incidents based on severity of the incident, which includes escalation to our executive leadership team and other management committees and assessment of materiality of cybersecurity incidents individually and in the aggregate.


text: The cybersecurity program at Cars Commerce is part of our enterprise risk management program. At Cars Commerce, we believe cybersecurity risk management is of the utmost importance. As a result, Cars Commerce has implemented an information security management system (the "ISMS") designed to protect our infrastructure from potential threats and to allow us to assess, identify and manage material risks from cybersecurity threats as described in more detail below. The ISMS supports the security safeguards that are designed to protect the confidentiality, integrity, availability, and contractual compliance of the Cars.com Inc. (d/b/a Cars Commerce, Inc.) entities, which include Cars.com LLC, Accu-Trade, LLC, CreditIQ, LLC, DealerRater.com LLC and Dealer Inspire Inc. which is inclusive of the In-Market Video and NewCars brands. In addition, we engage with external resources to contribute to, and provide independent evaluation of, our existing cybersecurity practices. As a result, in 2023, Cars Commerce engaged an independent auditor to conduct an audit of the ISMS, and Cars Commerce completed the certification to meet International Organization for Standardization 27001 requirements for the above-stated entities. In October 2024, Cars successfully completed its ISO 27001 surveillance audit. In November 2023, Cars Commerce, through its subsidiary, completed the acquisition of D2C Media. During the due diligence, Cars Commerce completed an evaluation of its cybersecurity risk management process and plans to integrate D2C Media into the ISO 27001 certification process.

companyName: Cars.com Inc.

ticker: CARS


text: Protect. Our employees are the first line of defense against cybersecurity incidents. As such, employees receive annual security awareness training to understand the behaviors and technical requirements necessary to protect information. We also conduct annual phishing awareness exercises to educate employees to recognize and report suspicious activity. We also use a combination of tools and in-house technologies to protect Cars Commerce, our employees and our customers, including but not limited to using only SOC 2 compliant hosting providers, anti-malware software, intrusion prevention systems, network and web application firewalls, multi-factor authentication, encryption, and remote access via virtual private network ("VPN") software.


text: Assess. In addition to in-house assessments, we engage with security and technology vendors to assess our information security and cybersecurity program and test our technical capabilities, including conducting penetration testing. We conduct risk assessments and audits to identify new risks and include any newly identified risks in remediation planning, as well as confirming that previously identified risks have been remediated. Identified risks are included in a central risk register and assigned an overall risk score. Risk levels are assigned based on a number of factors, including the nature of the risk and likelihood of exploitation. Lastly, we create remediation plans to bring unacceptable risks to an acceptable level.


text: Identify. We use several methods to identify cybersecurity events, including, but not limited to, security alert tools, log monitoring by systems engineers working on operational incidents that are later determined to be security incidents, or suspicious activity reported directly by employees. Cars Commerce has developed security incident response procedures to (1) assess cybersecurity incidents, (2) identify and implement containment measures, (3) preserve evidence, (4) log response activities and (5) determine corrective actions to prevent similar incidents.


text: Respond and Manage. When detected, suspected cybersecurity threats are escalated to the Information Security Team (as described below) in various ways based on the nature of the cybersecurity incident, including but not limited to system engineer escalation, the Cars Commerce helpdesk and in-house and third-party security tools. Cars Commerce employees are also responsible for reporting any suspected cybersecurity or information security event that they observe or experience as soon as possible, by either contacting the Cars Commerce helpdesk, or the Information Security Team directly. The Information Security Team then creates a Security Incident Response Team ("SIRT") which, depending on the incident, is comprised of cybersecurity staff, Systems and Network Engineers, the Chief Technology Officer and the Chief Legal Officer, or other stakeholders as appropriate. The SIRT investigates and manages the impact of cybersecurity incidents in accordance with the security incident response procedures.


text: Report. Following the conclusion of a security investigation, the SIRT prepares a report for the Information Security Governance Committee, as appropriate. The report includes information about the incident, details about the response and includes recommendations to prevent similar security events from occurring in the future. Additionally, the Information Security Team provides the Audit Committee and the Board with regular updates on cybersecurity matters, including recent cybersecurity threats and incidents and ongoing efforts to prevent, detect and respond to internal and external cybersecurity threats.


text: As of the date of this Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, Cars Commerce, including our business strategy, results of operations or financial condition. However, there can be no assurance that our cybersecurity prevention and mitigation efforts have been or will continue to prevent possible cybersecurity threats or whether a cybersecurity threat could have a material adverse effect on our business strategy, results of operations or financial condition. See "Risks Related to Technology" in "Risk Factors" of this Report.


text: The SEC adopted rules requiring the disclosure of material cybersecurity incidents. To ensure compliance with the SEC requirement, Cars Commerce has a review process to determine whether the impact of a cybersecurity threat is material and requires disclosure of the cybersecurity incident. In compliance with the SEC rule and Cars Commerce's process, if such a cybersecurity incident occurs and the appropriate representatives from the Information Security Governance Committee determine that the cybersecurity incident is material, Cars Commerce will make the appropriate disclosures in a Current Report on Form 8-K within the required timeframe.


text: The Board of Directors provides strategic guidance regarding Cars Commerce's overall risk oversight, including identification, management and mitigation of risk. The Board has delegated direct cybersecurity and information security risk oversight to the Audit Committee. Cars Commerce management provides the Audit Committee with regular updates at least quarterly regarding the effectiveness of Cars Commerce's overall cybersecurity program and other cybersecurity related matters, which may include, Cars Commerce's inherent cybersecurity risks, updates on recent cybersecurity threats and incidents, policies and practices, industry trends, regulatory developments, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external cybersecurity threats. The Chair of the Audit Committee informs the Board of the outcome of these meetings through updates presented to the Board at regularly scheduled Board meetings.


text: At the management level, our CEO provides general management, oversight and mitigation of Cars Commerce's risk. Our Chief Technology Officer and Senior Vice President of Information Security manage Cars Commerce's Information Security function. The Information Security Team is composed of skilled professionals with relevant information and cybersecurity education, certifications and experience. The Information Security Team coordinates with the Cars Commerce Information Security Governance Committee, comprised of senior business leaders who support Cars Commerce's Information Security Management System based on their area of expertise. Cars Commerce's Information Security Team, in conjunction with the Information Security Governance Committee, assesses and manages material risks from cybersecurity threats and provides management direction and support for information security. Working together the teams initiate and control the implementation and operation of information security within Cars Commerce.


text: Item 2. Properties. We do not own any material real property. Our principal executive offices are located in Chicago, Illinois. We also lease a production studio in Chicago, Illinois and administrative offices in Canada. We terminated our Naperville, Illinois office lease effective February 2024.


text: Item 3. Legal Proceedings. From time to time, the Company and its subsidiaries may become involved in actions, claims, suits or other legal or administrative proceedings arising in the ordinary course of business. The Company does not expect, based on circumstances currently known, that the ultimate resolution of any of these proceedings will have, either individually or in the aggregate, a material adverse effect on the Company's consolidated financial position, results of operations or cash flows. We hereby incorporate by reference Note 10 (Commitments and Contingencies) to the Consolidated Financial Statements included in Part II, Item 8. "Financial Statements and Supplementary Data" of this Annual Report on Form 10-K.


text: We have established policies and processes for identifying, assessing, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We design and are assessing our cybersecurity risk management program based on the ISO 27001:2022 standard, for which we received certification in 2024. We use the ISO 27001:2022 framework as a structure to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Merus N.V.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information technology systems that are vulnerable to cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our IT department who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process. The cybersecurity risk management program also includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through regular communication, trainings and mock cybersecurity exercises to increase company awareness.


text: We engage consultants, auditors or other third parties in connection with our risk assessment processes. These parties assist us with designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards, and investigations on an as needed basis. We contractually require third-party service providers to implement and maintain appropriate security measures, consistent with applicable laws, to implement and maintain reasonable security measures in connection with their work with us.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please see section "Risk Factors --Our information technology systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business," in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Operating Officer and management team are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from the Head of IT Security and Compliance, the supporting internal team and support of third-party service providers.


text: Our Chief Operating Officer oversees our cybersecurity policies and processes, including those described in "Cybersecurity Risk Management and Strategy" above.


text: Our Chief Operating Officer and Head of IT Security provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and policy and procedures, and changes in applicable law or regulations concerning such subject matter. Our audit committee is charged with, and is able to pass resolutions relating to the application of information and communication technology by the Company, including risks relating to cybersecurity. Moreover, periodic briefings are also provided to the board of directors relating to our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and policy and procedures, and changes in applicable law or regulations concerning such subject matter.


text: Our team that is responsible for assessing and our material risks from cybersecurity threats, including our Chief Operating Officer, Chief Financial Officer, and Executive Director, Head of IT Security and Compliance, which collectively have more than a combined 30 years of risk management experience. Our team's experience includes the Executive Director, Head of IT Security and Compliance, who has an extensive (25+ years) track record on cyber- and IT risks management, developing security and compliance programs and frameworks and leading IT security organizations, our Chief Financial Officer who, serving that role at Merus and prior companies and serving previously as Audit Committee chairperson for Merus and current Audit Committee chairperson at Kala Pharmaceuticals, has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, while evaluating strategies to gain a high level of cyber security, and our Chief Operating Officer, who has managed the IT organization at Merus for approximately five years and has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, and review of U.S. jurisprudence concerning protection of confidential information and trade secrets and has participated in trainings on cybersecurity threat defense and response, and cybersecurity strategies from a legal perspective.


text: We are committed to protecting the privacy and security of our information assets and the data entrusted to us. Our cybersecurity program comprises multiple levels of physical, technical, and administrative safeguards. Our cybersecurity program is informed by industry standards, including the Center for Information Security (CIS) framework for security controls and benchmarks, the National Institute of Standards and Technology (NIST) standards, and the ISO 27000 framework. This does not imply that we meet any particular technical standards, specifications, or requirements at all times, only that we use CIS, NIST, and ISO 27000 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration results in cybersecurity considerations as a key part of our decision-making processes. Our cybersecurity team considers emerging threats and new vectors of cyberattack and pursues a deliberate risk-avoidance approach. We also maintain our written security incident response runbook detailing the response and notifications involved with various security events.


text: Our cybersecurity training and education emphasizes periodic phishing tests and a mandatory training curriculum to assist our employees' awareness of common types of attacks. This includes awareness of phishing, malware, social engineering, and overall security best practices for new and existing employees. We also perform periodic, independent risk assessments that consider four primary areas of risk: physical, digital, social, and administrative/governance.


text: Since we understand that cybersecurity threats are complex and evolving, we have a dedicated team of both internal and external cybersecurity experts, which is led by our Chief Information & Cybersecurity Officer ("CICSO"). This team is responsible for publishing information technology and security policies, promoting compliance with those policies, implementing a program to mitigate potential threats, and performing periodic risk and maturity assessments. Our risk mitigation measures include network segmentation, cyber protection and containment, detection and response, and recovery. The primary goal of this team is to decrease the risk of cyber incidents having a material impact.


text: We also have plans in place to respond to cybersecurity incidents. These plans address issues relating to preparation for and detection of incidents, as well as responding to and recovering from incidents. We have procedures designed to assess, investigate, contain, remediate, and mitigate cybersecurity incidents, as well as procedures that seek to comply with legal obligations and regulatory reporting requirements. We periodically engage with assessors, consultants, auditors, and other third parties to review our cybersecurity processes.


text: Recognizing the risks associated with third-party service providers, we implement processes to manage these risks. We conduct assessments of critical third-party providers before engagement and maintain ongoing monitoring to assess compliance with our cybersecurity standards. In addition, we require SOC 1 Type II attestations from those IT vendors whose applications or cloud infrastructure handle sensitive information.


text: In the past three years, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the risk factor entitled "Our information technology systems may be subject to breaches, cyber-attacks or other disruptions that could, among other adverse consequences, cause us to violate laws and regulations and could adversely affect our business, results of operations, financial condition, cash flows, reputation or competitive position."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee responsibility for oversight of risk assessment and risk management, including cybersecurity, and the Company's policies and controls relating to information technology, management information systems, and cybersecurity. The Audit Committee receives quarterly reports from management on our cybersecurity risk management activities. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.


text: The CICSO has over three decades of technology experience, working for leading technology and consulting companies and previously served as chief information and cybersecurity officer for both public and private medical device and healthcare organizations. Our cybersecurity team includes a former chief information security officer for large healthcare organizations, a former head of global security for a major enterprise cybersecurity platform, and other similarly credentialed professionals. Our CICSO reports to the Chief Financial Officer and provides regular reports to the Audit Committee on cybersecurity policies, procedures, and risk and remediation efforts. Our CICSO also serves on our Disclosure Committee and has regular dialogue with the senior management team on information security matters and risk management practices.


text: The CICSO is regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We believe this ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The cybersecurity team implements and oversees processes for the regular monitoring of our information systems. In the event of a cybersecurity incident, the cybersecurity team follows a written security incident response runbook, which includes procedures to, among other things, respond to the incident, mitigate its impact, and evaluate and satisfy applicable obligations.


text: As part of our overall approach to integrated risk management, we have established an information security program that includes policies, processes, and organizations to assess, identify and manage risk from information security threats, including cybersecurity threats, and including risks related to third parties, such as partners, vendors, and suppliers. The program also includes an incident response plan that is designed to provide controls and procedures for responding to cybersecurity or other security incidents. We have established an Information Security team that is responsible for overseeing the program across the Company, including with respect to information, personnel, and facilities. The Information Security team is led by our Chief Information Security Officer, or CISO, who coordinates with other departments in areas such as facilities, physical security, operations, data protection, information technology, product development, finance, legal and compliance.

companyName: OneStream, Inc.

ticker: OS


text: Regular assessments and reviews, through both internal and external experts, are conducted on OneStream information assets and networks, including systems, devices, applications, solutions and related computing resources, to evaluate potential risks and vulnerabilities, identify actions to be taken, and evaluate the effectiveness of our cybersecurity program. Risk management exercises occur regularly and in response to changes in Company operations, risk landscape, and threat actor activities, using tabletop exercises, threat modeling, risk forecasting, and other techniques to monitor and evaluate the sufficiency of our policies, processes and controls. Internal assessments occur based on results from risk management exercises, changes in infrastructure, cybersecurity risks, threat actor activity, and in response to other internal or external events. External assessments are conducted by third-party assessors, consultants or auditors, as relevant, and occur regularly in order to maintain our certifications and accreditations with certain compliance regimes (for example, FedRAMP). Additionally, the Company utilizes third-party software, services and providers in our cybersecurity program in furtherance of our security processes such as endpoint security, threat intelligence, cloud security, and authentication services.


text: We also provide employees with policies and training in areas such as ethics, information security, social engineering, data protection, and compliance, and with regular updates on the cybersecurity program and potential threats.


text: We are aware of the risks associated with engaging third-party service providers and other third parties. We have implemented risk-based processes to oversee and manage these risks, including, where appropriate, contractual requirements to implement technical, administrative, cybersecurity, and physical measures to protect the security and confidentiality of OneStream information (including customer information), and to notify the Company promptly of relevant security incidents. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: We face a number of cybersecurity risks in connection with our business. To date, our business, operating results and financial condition have not been materially affected by cybersecurity incidents. For additional information, please refer to Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including the risk factors under the section titled "Risk Factors—Risks Related to our Technology and Intellectual Property."


text: Management is responsible for the day-to-day management of risks we face, including risks related to cybersecurity. Primary responsibility for our cybersecurity program is assigned to our CISO, who joined OneStream in May 2017 and has served as our CISO since December 2020. He has over 28 years of cybersecurity experience in the commercial and government sectors and works directly with the Information Security team to oversee and implement our cybersecurity program, including the policies and processes described in "Risk Management and Strategy" above. Our CISO reports directly to our Chief Risk Officer, or CRO. The CISO and the CRO both participate in regular meetings of our Operations and Risk Committee, a management committee which monitors risks across the Company, including cybersecurity and other information security risks.


text: Our board of directors, which has overall responsibility for enterprise risk management, has delegated to our audit committee primary oversight of cybersecurity risks and the processes to manage them. The audit committee regularly reviews and discusses with our CISO, CRO, and other senior management our policies and processes designed to identify, monitor and address enterprise risks, including risks from cybersecurity threats and incidents. Material cybersecurity threat risks are also considered during board of directors and audit committee meeting discussions of matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters. In addition, at least annually, our board of directors discusses our programs and policies related to cybersecurity and considers them from a risk management perspective and as part of OneStream's business strategy.


text: As our Information Security team monitors the security and effectiveness of our policies and processes, they also work to keep the CISO, CRO and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure. Depending on the nature and severity of an incident, this reporting structure provides for escalating notification to our CEO and the board of directors.


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and commercially sensitive or confidential information. Our business depends on the proper functioning and availability of our information technology platforms, including communications and data processing systems. We are also required to effect electronic transmissions with third parties including clients, vendors and others with whom we do business, and with our Board. We also recognize that, as we continue to increase our dependence on information technologies to conduct our operations the risks associated with cybersecurity also increase.

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: We utilize an enterprise-wide risk management process to identify, assess, track and manage risks faced by our organization. The Company's Enterprise Risk Management Committee ("ERM Committee"), is designated with the responsibility to direct our risk management program and to execute our risk management strategy, including cyber, technology, and third-party risk. To protect our information systems and operations from risks and to execute our cyber strategy, we use various security processes and technology tools that help identify, investigate, assess, prevent, and resolve potential vulnerabilities and security incidents in a timely manner. These include, but are not limited to, detection, monitoring and reporting processes and tools. Our team uses widely adopted methods and models to identify, evaluate, prioritize, and manage cyber and technology risks and develop and implement related information security safeguards. In partnership with third party advisors and consultants, we conduct regular reviews and tests of our program and leverage audits, penetration and vulnerability testing, cyber risk tabletops and security awareness trainings, and other business resilience exercises to evaluate the effectiveness of our program and improve our security measures. Our information security policies are designed to address current applicable legal requirements and to align with industry-recognized frameworks for cyber risk management. These standards cover physical, administrative, and technical safeguards and address a wide range of current cyber threats, including from third-party service providers. These policies and standards are reviewed and updated on a regular basis in order to respond to the constantly changing threat landscape.