text: Based on our assessment process, we implement and maintain various technical, physical, and organizational measures designed to manage and mitigate cybersecurity risks and potential material impacts. Depending on the environment or systems, we implement measures designed to prevent, detect, respond to, mitigate, and recover from identified and significant cybersecurity threats. The risk management and reduction measures we implement for certain of our environments or systems include: policies and procedures designed to address cybersecurity threats, including an incident response policy, acceptable use policy, and vulnerability management policy; internal and/or external audits of some environments to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; encryption of certain data; network security controls in certain systems; physical and electronic access controls in certain environments; asset management, tracking and disposal; systems monitoring of certain systems; employee security training; penetration testing of certain environments; and maintaining cyber insurance; and a dedicated cybersecurity officer.


text: Our business, results of operations, or financial condition could be materially affected as a result of such risks, due to: the cost of and modification of business activities related to prevention or incident response; potential system failure, data loss, fraud or theft, or other material adverse consequences; disruptions, including in operations, due to potential delays in remediation of high risk or critical vulnerabilities; costs of notices and other disclosures that may be required by applicable data privacy and security obligations; or our inability to recover such costs under insurance policies or contractual rights. See "Risks Related to Our Business" in Item 1A, Risk Factors for more information.

companyName: Dutch Bros Inc.

ticker: BROS

secItem: Item 1C


text: The Audit and Risk Committee of the board of directors is responsible for oversight of the Company's processes and policies for enterprise risk identification, management, and assessment, including key risks around data privacy, technology, and information security. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Technology Officer (CTO), Leigh Gower, who has more than 20 years of experience in the information technology field, including work in cybersecurity risk management. Prior to serving the Company, our CTO gained cybersecurity experience serving as Vice President, Technology at Blue Nile, as Senior Director, Product & Technology at T-Mobile, and as Management Consultant at Slalom Consulting.


text: Our CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO and her team are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including reporting certain incidents to a cross-functional group responsible for making ongoing assessments of reported incidents, led by our Chief Legal Officer and Chief Technology Officer, and includes members of our standing Disclosure Committee. The Chief Legal Officer is responsible for informing the Audit and Risk Committee regarding the Company's significant cybersecurity threats and risk and meets with the Audit and Risk Committee at periodic or special meetings to review and discuss issues. Our Chief Legal Officer oversees an annual enterprise risk assessment that addresses certain applicable cybersecurity risks, the results of which are presented to the Audit and Risk Committee. We engage a third party consulting firm to assist with the annual enterprise risk assessment. Our Chief Legal Officer works with the Board, senior management, others at various levels of the organization, and our outside advisors to help identify, assess, and validate the Company's top risks, taking into account past risk mitigation activities and future plans. Under our Cybersecurity Incident Reporting Policy, the Chief Legal Officer is also responsible for communicating to the Audit and Risk Committee the activities of the Company related to the assessments and reporting of potentially significant cybersecurity incidents.


text: We rely on information technology networks and systems and data processing to manage a variety of business processes and activities, including, without limitation, to process customer payments and conduct our marketing efforts. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, and customer data.


text: We utilize certain third-party service providers to perform a variety of functions, such as outsourcing certain business critical functions, augmenting staff for after-hours support, help tracking chain of custody for physical PCI devices for our shops, providing applications, hosting our systems, distributing our products, property management, providing cloud-based infrastructure, data center facilities, encryption and authentication technology, supporting corporate productivity services, and other functions. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, for certain service providers, our vendor management process includes reviewing the cybersecurity practices of certain providers, contractually imposing obligations on certain providers related to the services they provide and/or the information they process, conducting security vulnerability assessments, requiring providers to complete written questionnaires regarding their services and data handling practices, conducting periodic re-assessments during their engagement, using a third party vendor management security company to provide certain ongoing monitoring, or annually collecting certain information security-related compliance documentation and reports.


text: Risks from cybersecurity threats are among those that we address in the Company's general risk management program. As part of our overall risk management processes, the Company maintains various policies related to information security, including, for example, an Incident Response Policy and a Cybersecurity Incident Reporting Policy. We identify cybersecurity threats as part of our risk management processes, including (depending on the environment or systems) through internal monitoring, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environments, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats, and conducting security vulnerability assessments to identify vulnerabilities. Our information technology team is responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks under the oversight of our Chief Technology and Information Officer. This team works with third parties from time to time to help identify, assess, and manage cybersecurity risks, including professional services firms and other vendors.


text: Based on our assessment process, we implement and maintain various technical, physical, and organizational measures designed to manage and mitigate cybersecurity risks and potential material impacts. Depending on the environment or systems, we implement measures designed to prevent, detect, respond to, mitigate, and recover from identified and significant cybersecurity threats. The risk management and reduction measures we implement for certain of our environments or systems include: policies and procedures designed to address cybersecurity threats, including an incident response policy, acceptable use policy, and vulnerability management policy; internal and/or external security audit assessments of select environments to assess our exposure to cybersecurity threats, compliance with risk mitigation procedures, and the effectiveness of relevant controls; documented risk assessments; encryption of certain data; network security controls in certain systems; physical and electronic access controls in certain environments; asset management, tracking and disposal; systems monitoring of certain systems; employee security training; penetration testing of certain environments; maintaining cyber insurance; and a dedicated cybersecurity leader.


text: Our business, results of operations, financial condition, or reputation could be materially affected as a result of certain risks from cybersecurity threats, including for example, due to: the cost of and modification of business activities and implementation of security measures; system failure, data loss, fraud or theft; disruptions, including in operations; delays in remediation of high risk or critical vulnerabilities; costs of notices and other disclosures that may be required by applicable data privacy and security obligations; or our inability to recover such costs under insurance policies or contractual rights. See "Risks Related to Our Business" in Item 1A, Risk Factors for more information and a description of the risks from cybersecurity threats that materially affect the Company.


text: The Audit and Risk Committee of the board of directors is responsible for oversight of the Company's processes and policies for enterprise risk identification, management, and assessment, including certain risks around data privacy, technology, and information security. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Technology and Information Officer, Venki Krishnababu, who has over 30 years of experience in the information technology field. Prior to serving the Company, Mr. Krishnababu served in various information technology roles, most recently as Chief Technology Officer, at lululemon athletica inc. (NASDAQ: LULU), and prior to that as Chief Technology Officer at Premera Blue Cross.


text: Our Chief Technology and Information Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Technology and Information Officer and his team are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including reporting certain incidents to a cross-functional group responsible for making ongoing assessments of reported incidents. This group is led by our Chief Legal Officer and Chief Technology and Information Officer, and includes members of our standing Disclosure Committee. The Chief Legal Officer is responsible for informing the Audit and Risk Committee regarding certain significant cybersecurity threats and risks, and meets with the Audit and Risk Committee periodically or at special meetings to review and discuss issues. Additionally, our Chief Legal Officer oversees an annual enterprise risk assessment that addresses certain applicable cybersecurity risks, the results of which are presented to the Audit and Risk Committee. We also engage a third party consulting firm to assist with our annual enterprise risk assessment. Our Chief Legal Officer works with the Board, senior management, others at various levels of the organization, and our outside advisors to help identify, assess, and validate the Company's top risks, taking into account past risk mitigation activities and future plans. Under our Cybersecurity Incident Reporting Policy, the Chief Legal Officer is also responsible for communicating to the Audit and Risk Committee the activities of the Company related to the assessments and reporting of potentially significant cybersecurity incidents.


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives presentations at least quarterly from members of our team responsible for overseeing the Company's cybersecurity risk management, including the Chief Information Security Officer (CISO), Chief Technology Officer (CTO), Chief Legal Officer (CLO), and Head of Internal Audit, which address topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. Then, the Audit Committee and such members of our management team report to the Board on a quarterly basis, with an in-depth review at least annually, on data protection and cybersecurity matters. Additionally, the Company has protocols for cybersecurity incidents that meet established reporting thresholds for escalation within the Company including, where appropriate, reporting to the Board and Audit Committee, with required updates for ongoing matters until any such incident has been addressed and resolved.


text: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. At the management level, our Cybersecurity and Governance Council, composed of the CISO, CTO, CLO, Chief Revenue Officer and EVP of Operations, and Head of Internal Audit has broad oversight of the Company's risk management processes. The Cybersecurity and Governance Council meets regularly to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO invites team members from the product and technology groups to attend each Cybersecurity and Governance Council meeting to report on ongoing or relevant cybersecurity and compliance matters. The Cybersecurity and Governance Council reports any material developments to the Audit Committee on a quarterly basis.


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business. The CISO receives reports on cybersecurity threats from industry threat reports, and the team members in Information Security who are responsible for various parts of the business on an ongoing basis and in conjunction with management regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO and the team work closely with Legal and Internal Audit to oversee compliance with legal, regulatory, and contractual security requirements.


text: The Company employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.


text: The Company's Information Security Policy ("Policy") is based upon the ISO 27001, HITRUST CSF, SOC 2 Type 2, and PCI DSS frameworks and standards and provides specific and detailed direction and support for appropriately maintaining the overall security, confidentiality, integrity, and availability of information within the Company. The Policy covers all processes, equipment, hardware, and software owned or under the control of the Company as well as networks operated by third parties containing Company information or processes. It addresses the Company's procedures and controls for, including but not limited to, asset and data management, user access and authentication, personnel education/trainings, change management, risk management, system configurations, security monitoring and reporting, vulnerability management, and business continuity and disaster recovery. The Policy applies to all employees, consultants, contractors, and other such persons ("Personnel") with access to the aforementioned processes, equipment, hardware, and software. The Policy requires that Personnel agree to and are trained annually on all components of the Policy as a condition of employment, partnership, or temporary affiliation with the Company.


text: All Company employees must complete trainings at least annually on various security threats and best practices including, but not limited to, trainings on the following topics: the Company's Information Security Policy; Information Security Incident Response Plan; HIPAA, PCI Compliance; GDPR and CCPA; Security Awareness and Incident Response Training covering Social Engineering Phishing (identification and common red flags), Social Media safety best practices, Internet Security best practices, and Incident response training for end-users; and Phishing. In addition, our developers must complete Secure Code / Secure Application Development Training based on OWASP top 10 standards.


text: Our Company has adopted an Information Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.


text: The IRP requires an Information Security Incident Response Team ("IRT") which includes, at a minimum, the following representatives: CTO, CISO, CLO, Data Protection Officer, and department heads of Network Operations, Engineering, and Information Security to oversee all details of the incident response. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: In addition to our internal cybersecurity capabilities, we regularly engage with consultants, and other third parties to assist with assessing, identifying, and managing cybersecurity risks. Specifically, the Company is engaged with third party auditors for HITRUST, PCI, and SOC 2 Type 2 for annual certification. We are also engaged with a third party Data Protection Officer to oversee compliance with the General Data Protection Regulation (GDPR).


text: While we have not experienced any risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. We also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Form 10-K under the heading "Risks Related to our Business," which should be read in conjunction with the foregoing information.


text: Board of Directors Our Board of Directors, in coordination with the Audit Committee of the Board of Directors (the "Audit Committee"), oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives presentations at least quarterly from members of our team responsible for overseeing the Company's cybersecurity risk management, including the Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO"), Chief Legal Officer ("CLO"), and Head of Internal Audit, which address topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. Then, the Audit Committee and such members of our management team report to the Board of Directors on a quarterly basis, with an in-depth review at least annually, on data protection and cybersecurity matters. Additionally, the Company has protocols for cybersecurity incidents that meet established reporting thresholds for escalation within the Company including, where appropriate, reporting to the Board of Directors and Audit Committee, with required updates for ongoing matters until any such incident has been addressed and resolved.


text: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. At the management level, our Cybersecurity and Governance Council, composed of the CISO, CTO, CLO, Chief Revenue Officer and Executive Vice President of Operations, and Head of Internal Audit has broad oversight of the Company's risk management processes. The Cybersecurity and Governance Council meets regularly to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO invites team members from the product and technology groups to attend each Cybersecurity and Governance Council meeting to report on ongoing or relevant cybersecurity and compliance matters. The Cybersecurity and Governance Council reports any material developments to the Audit Committee on a quarterly basis.


text: Information Security Policy and Requirements The Company's Information Security Policy ("Policy") is based upon the International Organization for Standardization ("ISO") 27001, Health Information Trust Alliance ("HITRUST") Common Security Framework ("CSF"), System and Organization Controls 2 Type 2 ("SOC 2 Type 2"), and Payment Card Industry Data Security Standard ("PCI DSS") frameworks and standards and provides specific and detailed direction and support for appropriately maintaining the overall security, confidentiality, integrity, and availability of information within the Company. The Policy covers all processes, equipment, hardware, and software owned or under the control of the Company as well as networks operated by third parties containing Company information or processes. It addresses the Company's procedures and controls for, including but not limited to, asset and data management, user access and authentication, personnel education/trainings, change management, risk management, system configurations, security monitoring and reporting, vulnerability management, and business continuity and disaster recovery. The Policy applies to all employees, consultants, contractors, and other such persons ("Personnel") with access to the aforementioned processes, equipment, hardware, and software. The Policy requires that Personnel agree to and are trained annually on all components of the Policy as a condition of employment, partnership, or temporary affiliation with the Company.


text: Employee Trainings All Company employees must complete trainings at least annually on various security threats and best practices including, but not limited to, trainings on the following topics: the Company's Information Security Policy; Information Security Incident Response Plan; HIPAA, PCI Compliance; General Data Protection Regulation ("GDPR") and CCPA; Security Awareness and Incident Response Training covering Social Engineering Phishing (identification and common red flags), Social Media safety best practices, Internet Security best practices, and Incident response training for end-users; and Phishing. In addition, our developers must complete Secure Code / Secure Application Development Training based on Open Web Application Security Project top 10 standards.


text: Our Company has adopted an Information Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the National Institute of Standards and Technology ("NIST") framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.


text: Third-Party Certifications and Audits In addition to our internal cybersecurity capabilities, we regularly engage with consultants, and other third parties to assist with assessing, identifying, and managing cybersecurity risks. Specifically, the Company is engaged with third-party auditors for HITRUST, PCI, and SOC 2 Type 2 for annual certification. We are also engaged with a third-party Data Protection Officer to oversee compliance with the GDPR.


text: Material Cybersecurity Risks, Threats & Incidents While we have not experienced any risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that, to our knowledge, have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Form 10-K under the heading "Risks Related to our Business," which should be read in conjunction with the foregoing information.


text: In the normal course of business, we collect and store personal information and other sensitive information, including proprietary and confidential business information, intellectual property, information regarding patients, sensitive third-party information and employee information. To protect this information, we have implemented a framework that is designed to identify, assess, and mitigate cybersecurity threats.

companyName: Xeris Biopharma Holdings, Inc.

ticker: XERS


text: We use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we engage third parties to perform penetration testing and to assess the effectiveness of our cybersecurity practices. We conduct a cybersecurity risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implementing strategies to mitigate these cybersecurity risks and their possible impacts. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: We have established a cybersecurity incident response plan and provide cybersecurity training to our employees and monitor their activity for adherence to our security protocols.


text: No risks from cybersecurity threats have occurred that have affected our business strategy, results of operations, or financial condition. See "Risk Factors - General Risk Factors" for additional information.


text: Our information security program is overseen by our Executive Director of Information Technology ("IT"). The Executive Director of IT reports to the Chief Financial Officer and oversees the team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, and processes. The Executive Director of IT possesses over twenty-five years of experience in information technology and approximately ten years in cybersecurity risk management.


text: Our Board of Directors ("Board") has responsibility for oversight of risk management and, pursuant to the Audit Committee Charter, has delegated to our Audit Committee oversight of our cybersecurity risk management program. The Executive Director of IT provides reports to the Audit Committee at least annually as well as the Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external security professionals with the results of those reviews reported to senior management and the Board.


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. See "Risk Factors - General Risk Factors" for additional information.


text: Our information security program is overseen by our VP of Information Technology ("IT"). The VP of IT reports to the Chief Financial Officer and oversees the team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, and processes. The VP of IT possesses over twenty-five years of experience in information technology and approximately ten years in cybersecurity risk management.


text: Our Board of Directors ("Board") has responsibility for oversight of risk management and, pursuant to the Audit Committee Charter, has delegated to our Audit Committee oversight of our cybersecurity risk management program. The VP of IT provides reports to the Audit Committee at least annually as well as the Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external security professionals with the results of those reviews reported to senior management and the Board.


text: Constellation has established programs and processes to manage material risks from cybersecurity threats including assessing and identifying existing cybersecurity risks, as well as continuously monitoring for developing risks. Our cybersecurity risk management strategy is established at the executive level and is implemented through our cybersecurity program which deploys risk-based security controls and services to protect our customers, personnel, information and cyber assets. The program aligns enterprise cyber and physical security controls with the National Institute of Standards & Technology (NIST) Cybersecurity Framework (CSF) and other industry standards such as the NERC and NRC cybersecurity standards. Cybersecurity risk is assessed and reported in our enterprise risk management program, which utilizes the Three Lines Model adapted from the Institute of Internal Auditors, for risk management to assign clear risk responsibilities across the enterprise. Through coordination with operational teams, we align on cybersecurity risk classification, categorization, likelihood, and potential impact to the company. At the highest level, our program includes multi-layered oversight by the Board of Directors and Board Committees.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: Our cybersecurity and physical security controls are implemented through policies and procedures which form the comprehensive framework we utilize for planning, performing, managing, assessing, innovating, and improving our security controls. Our defense-in-depth strategy to protect our cyber assets and sensitive information reduces the potential severity and duration of a cybersecurity incident by leveraging security measures across various layers of the enterprise. Cross-functional executive steering committees and peer groups, with business unit and technical stakeholder participation, are maintained to support oversight, security controls development, change management, implementation, evaluation, continuous improvement, and sustainment.


text: Our cybersecurity program is aligned to the five functions of the NIST Cybersecurity Framework – identify, detect, protect, respond, and recover. To protect our information and cyber assets, we implement practices for training and screening of personnel, access management, network defense, asset configuration management, vulnerability assessment (including penetration testing), third-party security, and privacy and information protection.


text: In addition, to detect cybersecurity events, we deploy security logging and monitoring, malicious code detection, and data loss protection tools. If the company is the target of a cybersecurity attack, we have established processes for incident response and crisis management to detect and triage potential incidents and determine severity, contain, and eradicate a threat. These processes also include steps to recover our systems and information through established and exercised system recovery plans and business continuity plans. Our incident response process includes steps to notify regulatory and other governmental authorities of cybersecurity events as required by law, including providing notice to investors for material cybersecurity events.


text: As part of our process to continuously improve, we utilize internal functions such as our internal audit and risk functions to evaluate security controls and risk management practices. We also engage third-party subject matter experts to independently assess our programs, processes and technical controls, as needed. For our regulated cyber assets associated with critical infrastructure, such as those within the scope of NERC and the NRC, regulatory auditors and inspectors monitor our adherence to mandatory cybersecurity requirements on a regular frequency using a variety of compliance monitoring and enforcement mechanisms.


text: Board Governance and Management Our Board is actively engaged in monitoring the performance of the Company's cybersecurity program and maintains oversight of the Company's enterprise risk program, including with respect to commodity markets, market design, enterprise security (physical and cyber), operating risks, and financial performance. While the full Board retains ultimate responsibility and oversight of the Company's cybersecurity risk management practices, the Nuclear Oversight Committee and the Audit and Risk Committee also have cybersecurity risk management as part of their charters. The Nuclear Oversight Committee is tasked with overseeing compliance with policies and procedures to manage and mitigate cybersecurity risks associated with our nuclear assets. The Audit and Risk Committee oversees policies and processes established by management to identify, assess, monitor, manage and control technology and cyber risks, among other risks. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) provide regular reports to the Board, or one or both of its designated Committees, regarding the security of our operational and information technology programs, systems, and risks. We also report on the state of our cybersecurity program and provide key risk indicators to track performance. Emergent matters or events are reported to the Board between scheduled meetings on an ad hoc basis through our incident response and crisis management protocols.


text: At the executive and management level, the Chief Administration Officer, via delegations to the Cyber and Physical Security organizations, is authorized to govern and functionally oversee our security controls and services on behalf of the enterprise. Our cybersecurity organization, under the direction of the CISO who reports to the CIO, implements and provides governance and functional oversight for cybersecurity controls and services. Our CIO has over 20 years of experience with information systems, including management roles in operational security, technical design and engineering, and platform architecture cybersecurity, governance and compliance, and business continuity. Our CISO has over 20 years of experience in cybersecurity, governance and compliance, physical security and business continuity. In addition, cybersecurity risk is assessed and tracked through the Company's enterprise risk management program.


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, we continue to closely monitor cyber risk. Overall, our company has implemented tactical processes for assessing, identifying, and managing material risks from cybersecurity threats to the company including governance at the Board level and accountability in our executive management for the execution of our cyber risk management strategy and the controls designed to protect our operations. See ITEM 1A. RISK FACTORS for additional information regarding the Company's cybersecurity risks.


text: Constellation has established programs and processes to manage material risks from cybersecurity threats including assessing and identifying existing cybersecurity risks, as well as continuously monitoring for developing risks. Our cybersecurity risk management strategy is established at the executive level and is implemented through our cybersecurity program which deploys risk-based security controls and services to protect our customers, personnel, information and cyber assets. The program aligns enterprise cyber and physical security controls with the National Institute of Standards & Technology (NIST) Cybersecurity Framework (CSF) and other industry standards such as the NERC and NRC cybersecurity standards. Our cybersecurity program is aligned to the five functions of the NIST Cybersecurity Framework – identify, detect, protect, respond, and recover. Cybersecurity risk is assessed and reported in our enterprise risk management program, which utilizes the Three Lines Model adapted from the Institute of Internal Auditors, for risk management to assign clear risk responsibilities across the enterprise. Through coordination with operational teams, we align on cybersecurity risk classification, categorization, likelihood, and potential impact to the company. At the highest level, our program includes multi-layered oversight by the Board of Directors and Board Committees.


text: Our cybersecurity and physical security controls are implemented through policies and procedures we utilize for planning, performing, managing, assessing, innovating, and improving our security controls. To protect our information and cyber assets, we implement practices for training and screening of personnel, access management, network defense, asset configuration management, vulnerability assessment (including penetration testing), third-party security, and privacy and information protection. Our defense-in-depth strategy to protect our cyber assets and sensitive information reduces the potential severity and duration of a cybersecurity incident by leveraging security measures across various layers of the enterprise. Cross-functional executive steering committees and peer groups, with business unit and technical stakeholder participation, are maintained to support oversight, security controls development, change management, implementation, evaluation, continuous improvement, and sustainment.


text: To assist in detecting cybersecurity events, we deploy security logging and monitoring, malicious code detection, and data loss protection tools. If the company is the target of a cybersecurity attack, we have established processes for incident response and crisis management to triage potential incidents, determine severity, contain, and eradicate a threat. These processes require notifications to regulatory and other governmental authorities of cybersecurity events as required by law, including providing notice to investors for material cybersecurity events. To recover our systems and information, we utilize established system recovery plans and business continuity plans.


text: As part of our process to continuously improve, we utilize our internal audit, risk, and legal functions to evaluate security controls and risk management practices. We also engage third-party subject matter experts to independently assess our programs, processes and technical controls, as needed. For our regulated cyber assets associated with critical infrastructure, such as those within the scope of NERC and the NRC, regulatory auditors and inspectors monitor our adherence to mandatory cybersecurity requirements on a regular frequency using a variety of compliance monitoring and enforcement mechanisms.


text: At the executive and management level, the Chief Administration Officer, via delegations to the Cyber Security organization, is authorized to govern and functionally oversee our security controls and services on behalf of the enterprise. Our cybersecurity organization, under the direction of the CISO who reports to the CIO, implements and provides governance and functional oversight for cybersecurity controls and services, including coordination with our Corporate Security function. Our CIO has over 20 years of experience with information systems, including management roles in operational security, technical design and engineering, and platform architecture cybersecurity, governance and compliance, and business continuity. Our CISO has over 20 years of experience in cybersecurity, governance and compliance, physical security and business continuity. In addition, cybersecurity risk is assessed and tracked through the Company's enterprise risk management program.


text: Information technology supports all aspects of our business, including operations, marketing, sales, order processing, production and distribution networks, retail and professional hairstylist customer experience, consumer experience, finance, business intelligence, and product development. We continue to maintain and enhance our information technology systems, cybersecurity infrastructure and customer and consumer experiences in alignment with our long-term strategy. An increasing portion of our global information technology infrastructure is cloud-based and in partnership with industry-leading service providers. We believe this approach enables a high-performance platform to support current and future requirements and enhances our scale and flexibility to respond to the demands of the business by leveraging advanced and leading-edge technologies. We recognize that technology presents opportunities to build a competitive advantage, and we continue to invest in new capabilities across various aspects of our business. Such efforts, however, subject us to increased cyber risk, as these investments are subject to cyberattacks, business disruptions and other risks described in "Risk Factors – Risks Related to Information Technology and Cybersecurity."

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. As part of our company-wide enterprise risk management process, we conduct a comprehensive annual enterprise risk assessment that includes evaluation of cybersecurity risks and development of risk mitigation response plans. Company management reviews our enterprise risk assessment with our Audit Committee and our Board of Directors and provides periodic updates with respect to our risk mitigation response plans to our Audit Committee and our Board of Directors. We have established internal policies and procedures for cybersecurity risk management and incident response management that are based on industry standard cybersecurity frameworks, and we provide regular training to our employees regarding evolving cybersecurity threats and risk management.


text: Our cybersecurity team is primarily responsible for identifying, evaluating and responding to risks from cybersecurity threats. Our cybersecurity team is led by our Senior Vice President, Information Technology, who has an undergraduate degree in electronic and communications engineering and over 20 years of experience in information technology, including cybersecurity risk management. Our cybersecurity team reviews and assesses our cybersecurity profile against internal and external cybersecurity frameworks that are aligned with industry standards on an ongoing basis and conducts ongoing security management internally and through the engagement of third-party vendors and consultants. In addition, our cybersecurity team periodically engages independent third parties to conduct security assessments and internal and external penetration tests. Our cybersecurity team seeks to detect potential cybersecurity incidents through technical safeguards such as automatic detection systems, as well as through our policies and procedures that require internal and external notification of cybersecurity incidents. When a cybersecurity incident occurs, our cybersecurity team implements our incident management procedures and convenes an incident response team consisting of members of our IT team and other company representatives as appropriate based on the nature of the incident. The incident response team determines appropriate containment, eradication and recovery procedures based on the type of incident and recommends any corrective actions to the cybersecurity team following the resolution of the cybersecurity incident. Cybersecurity incidents are reported to our Board of Directors, our Audit Committee or its Information Security Subcommittee as appropriate based on the nature of the incident.


text: We rely on the information systems of third-party vendors, including our cloud vendors, for various functions of our business, including manufacturing, sourcing, distribution, sales and marketing. We engage a third-party risk management software to oversee and identify the risks from cybersecurity threats associated with relevant vendors, based on the services such vendors provide and the information to which they have access. In addition, as part of our new vendor onboarding procedures, we review proposed new vendors' cybersecurity and data protection practices and collaborate with such vendors to align their cybersecurity platforms with our expectations.


text: Our Audit Committee assists the Board of Directors in its oversight of our policies, procedures and practices with respect to risk management and mitigation, including risks related to information security, cybersecurity, and data privacy and protection. The Audit Committee has delegated oversight of risks related to information security, cybersecurity, and data privacy and protection to its Information Security Subcommittee, which meets at least twice a year with our Senior Vice President, Information Technology and other members of our IT department to discuss our cybersecurity profile and related risks, as well as to discuss updates on relevant developments in the cybersecurity threat environment. The Information Security Subcommittee reports to the Audit Committee following each subcommittee meeting, and the Audit Committee reports to our Board of Directors.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. Despite our continuing efforts, our cybersecurity platform may not prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, reduced demand, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Risk Factors – Risks Related to Information Technology and Cybersecurity."


text: Information technology supports all aspects of our business, including operations, marketing, sales, order processing, production and distribution networks, retail and Pro customer experience, consumer experience, finance, business intelligence, and product development. We continue to maintain and enhance our information technology systems, cybersecurity infrastructure and customer and consumer experiences in alignment with our long-term business strategy. An increasing portion of our global information technology infrastructure is cloud-based and is built and maintained in partnership with industry-leading service providers. We believe this approach enables a high-performance platform to support current and future requirements and enhances our scale and flexibility to respond to the demands of the business by leveraging advanced and leading-edge technologies. We recognize that technology presents opportunities to build a competitive advantage, and we continue to invest in new capabilities across various aspects of our business. Such efforts, however, subject us to increased cyber risk, as technology investments are subject to cyberattacks, business disruptions and other risks described in "Risk Factors – Risks Related to Information Technology and Cybersecurity" included in Part I. Item 1A of this Annual Report.


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. As part of the Company's enterprise risk management process, we conduct a comprehensive annual enterprise risk assessment that includes consideration of cybersecurity risks in conjunction with other Company risks. Our cybersecurity team further evaluates cybersecurity risks and develops risk mitigation response plans. We have established internal policies and procedures for cybersecurity risk management and incident response management that are based on industry standard cybersecurity frameworks, and we provide regular training to our employees regarding evolving cybersecurity threats and risk management. We also maintain cybersecurity insurance coverage that is intended to address certain costs that we may incur in the event that we experience a cybersecurity incident.


text: Our cybersecurity team is primarily responsible for identifying, evaluating and responding to risks from cybersecurity threats. Our cybersecurity team reviews and assesses our cybersecurity profile against internal and external cybersecurity frameworks that are aligned with industry standards on an ongoing basis and conducts ongoing security management internally and through the engagement of third-party vendors and consultants. In addition, our cybersecurity team periodically engages independent third parties to conduct security assessments and internal and external penetration tests. Our cybersecurity team seeks to detect potential cybersecurity incidents through technical safeguards such as automatic detection systems, as well as through our policies and procedures that require internal and external notification of cybersecurity incidents. When a cybersecurity incident occurs, our cybersecurity team implements our incident management procedures and convenes an incident response team consisting of members of our IT team and other company representatives as appropriate based on the nature of the incident. The incident response team determines appropriate containment, eradication and recovery procedures based on the type of incident and recommends any corrective actions to the cybersecurity team following the resolution of the cybersecurity incident. Our cybersecurity incident management procedures also include a framework to assess whether a cybersecurity incident is material and subject to SEC reporting requirements. Such procedures include the involvement of senior members of our cybersecurity team and other senior leaders across various functions.


text: We rely on the information systems of third-party vendors, including our cloud vendors, for various functions of our business, including manufacturing, sourcing, distribution, sales and marketing. We engage a third-party risk management software to oversee and identify the risks from cybersecurity threats associated with relevant vendors, based on the services such vendors provide and the information to which they have access. In addition, as part of our new vendor onboarding procedures, we review proposed new vendors' cybersecurity and data protection practices and certifications and collaborate with such vendors to align their cybersecurity platforms with our expectations.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations or financial condition. Despite our continuing efforts, we may face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. For more information, see "Risk Factors – Risks Related to Information Technology and Cybersecurity" included in Part I, Item 1A of this Annual Report.


text: Our Audit Committee assists the Board of Directors in its oversight of our policies, procedures and practices with respect to risk management and mitigation, including risks related to information security, cybersecurity, and data privacy and protection. Company management reviews our enterprise risk assessment with our Audit Committee and our Board of Directors and provides periodic updates with respect to our risk mitigation response plans to our Audit Committee and our Board of Directors. The Audit Committee has delegated oversight of risks related to information security, cybersecurity, and data privacy and protection to its Information Security Subcommittee, which meets at least twice a year with senior members of our cybersecurity team to discuss our cybersecurity profile and related risks, as well as to discuss updates on relevant developments in the cybersecurity threat environment. The Information Security Subcommittee reports to the Audit Committee following each subcommittee meeting, and the Audit Committee reports to our Board of Directors. Pursuant to our incident management procedures, cybersecurity incidents are reported to our Board of Directors, our Audit Committee or its Information Security Subcommittee as appropriate based on the nature of the incident.


text: At the management level, our cybersecurity team is led by the head of our information technology team, who is responsible for assessing and managing material risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents, and is a member of our incident response team. Our cybersecurity team has relevant academic degrees, multiple certifications, and real-world experience managing cybersecurity incidents and risks. The head of our information technology team has over 20 years of experience in information technology and cybersecurity, including previous employment as the chief information officer of multiple entities. Our broader cybersecurity team includes specialists that collectively have over 50 years of experience in information technology and/or cybersecurity and is supported by independent contractors. Our cybersecurity team works collaboratively to identify, assess and manage cybersecurity incidents and risks and implements and maintains centralized cybersecurity practices in coordination with senior leadership and cross functionally with other teams across the Company.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and as described further below, have integrated these processes into our overall risk management systems and processes. Our board of directors performs meaningful oversight of these cybersecurity risk management processes, and our management team is responsible for the day-to-day management of the material risks we face. Management roles in cybersecurity risk management.

companyName: Informatica Inc.

ticker: INFA


text: We have several committees and individual management positions responsible for assessing, identifying, and managing the material cybersecurity risks that we face. Enterprise Risk Management Committee.


text: Our Enterprise Risk Management Committee performs a central function in the assessment and management of our important business risks overall. Our Enterprise Risk Management Committee is comprised of members of our executive leadership. The committee meets periodically to review risk-related topics, including updates on cybersecurity risks and incidents, cybersecurity policy changes, and certain cybersecurity investment recommendations. The diverse skills and experience relevant to cybersecurity risk management possessed by the senior management and executive positions on this committee contribute to our effective management of such risks. The Enterprise Risk Management Committee is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through its Cybersecurity Steering Subcommittee and the Global Security Organization.


text: The Cybersecurity Steering Subcommittee oversees teams of subject matter experts and working groups assigned to focus on specific cybersecurity risk management issues, and receives periodic status updates from those teams.


text: The Enterprise Risk Management Committee provides reports to the audit committee of our board of directors on a quarterly basis to support its oversight of our cybersecurity risk management. Chief Information Security Officer.


text: Our Chief Information Security Officer ("CISO") leads our Global Security Organization. Our CISO supports our compliance with standards and contractual obligations relevant to cybersecurity and good risk governance. Our CISO has over ten years of experience focused on cybersecurity. Our CISO has degrees in computer science and management information systems, each with an emphasis on information security, and has certificates from the Global Information Assurance Certification program as an Information Security Professional and for Strategic Planning, Policy and Leadership. Our CISO has held senior positions focused on the management and operation of our cybersecurity risk management processes for over five years. In addition to its oversight, monitoring and other responsibilities, the Global Security Organization conducts an annual risk assessment process concerning our enterprise and product families. This process supports our prioritization, planning and execution of security program improvements. We also maintain a risk management process throughout the year designed to compile and manage risks through a variety of technical and administrative controls. Third-party cybersecurity risk management.


text: Our cybersecurity processes are designed to identify and address cybersecurity risks associated with our use of third-party technologies and service providers.


text: Our processes call for the evaluation of third parties for security and compliance risks before onboarding them for potential use within our own systems and services. For applicable vendors, we require audit reports and regular responses to our detailed security questionnaires particularly for vendors associated with critical assets. In addition, our procurement processes call for specific contractual obligations from relevant vendors regarding their maintenance of appropriate cybersecurity controls and relevant certifications. Our internal Software Development Lifecycle is designed to build our products in part relying upon industry-standard practices and third-party tools and services to test our code and bundled third-party libraries for known security misconfigurations and errors. Our people are a crucial pillar of our cybersecurity.


text: We operate processes to maintain an internal culture that expressly values cybersecurity. This includes broad-based processes for cybersecurity training, internal communications, reporting concerns, and escalations. Our security awareness and skills training processes guide behaviors across our workforce to be security conscious. Consultants provide valuable services within our cybersecurity risk management.


text: Our cybersecurity risk management processes and technical safeguards are supported by consultants and other service providers including for security assessments of our suppliers, independent risk assessments and forensic analyses. We have also retained third-party providers to monitor and assess our cybersecurity posture by a variety of security indicators, cybersecurity threat intelligence signals and other sources and methods. Incident response processes are an integral part of our cybersecurity posture.


text: If indications are reported of an actual or threatened incident affecting our information systems or networks, or affecting a third party provider relevant to our security, we commence our incident response processes led by the Global Security Organization. This comprehensive incident response process is designed to address possible and confirmed cybersecurity incidents and enable escalations and notifications to appropriate management and members of the audit committee.


text: After an incident has been contained our processes shift emphasis to the continuity of business operations, and if necessary, restoration of services and the recovery of any affected business systems and data. Board oversight of cybersecurity risk management.


text: On a quarterly basis either the audit committee or the full board of directors receive information regarding our cybersecurity risk management from our Global Security Organization and from a representative of our Chief Product Officer's organization. The chair of the audit committee also updates the full board of directors on specific topics that are presented or discussed at the regular meeting of the audit committee.


text: The audit committee also receives an annual review from the CISO regarding our cybersecurity strategies, including how changes in the threat landscape and changes to our risk posture and business and compliance requirements may affect our risk management strategies.


text: As a result of the significance of the cybersecurity threats to our business, we expend material efforts on our cybersecurity risk management processes, although we have not identified any specific threat or incident that has materially affected or is reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For additional information regarding our risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled: "A security breach or incident may compromise the integrity of our products, create service outages for our hosted products, or allow unauthorized access to our network or our customers' data, harm our reputation, create additional liability and adversely impact our financial results."


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which includes risks that arise from our use of AI, and as described further below, have integrated these processes into our overall risk management systems and processes. Our board of directors performs meaningful oversight of these cybersecurity risk management processes, and our management team is responsible for the day-to-day management of the material risks we face. Management roles in cybersecurity risk management.


text: The Cybersecurity Steering Subcommittee oversees teams of subject matter experts and working groups assigned to focus on specific cybersecurity risk management issues, and receives periodic status updates from those teams. This subcommittee also receives information from several specific risk-focused working groups such as an AI risk review team and a product AI and privacy working group.


text: If indications are reported of an actual or threatened incident affecting our information systems or networks, or affecting a third party provider relevant to our security, we commence our incident response processes supported by the Global Security Organization. This comprehensive incident response process is designed to address possible and confirmed cybersecurity incidents and enable escalations and notifications to appropriate management and members of the audit committee.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of GC Advisors and other third-party service providers. GC Advisors manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: GOLUB CAPITAL DIRECT LENDING CORP


text: Cybersecurity Program Overview GC Advisors has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. GC Advisors' cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. GC Advisors actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on GC Advisors to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on GC Advisors' risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of GC Advisors when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Financial Officer ("CFO") and Chief Compliance Officer ("CCO") regarding the overall state of GC Advisors' cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management GC Advisors' internal cybersecurity team, headed by GC Advisors' Chief Information Officer ("CIO"), are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes), and along with the Company's CCO and a Disclosure Committee that is headed by the Company's CFO (the "Disclosure Committee"), are responsible for assessing and managing material risks from cybersecurity threats that impact the Company.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company for over three years and has worked in the financial services industry for more than eighteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function as CCO to the Company since the Company commenced operations on July 1, 2021 and has worked in the financial services industry for more than twenty years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. The Advisors' CIO has been responsible for her function for over four years and has worked in the financial services industry for more than fifteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company, including the CCO and the Company's Disclosure Committee, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of GC Advisors.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on a regular basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company for over four years and has worked in the financial services industry for more than nineteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function since assuming her role as CCO to the Company and has worked in the financial services industry for more than 15 years, during which time the CCO has gained expertise in assessing and managing risk, including those applicable to the Company. The Advisors' CIO has been responsible for her function for over five years and has worked in the financial services industry for more than sixteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.


text: We manage our cybersecurity risks through an information security management system (ISMS) that falls under our overarching integrated management system (IMS) for quality and safety. Our cybersecurity risk management program and supporting ISMS focus our efforts on reducing residual risks to our critical corporate assets. The materiality of these risks drives the selection of appropriate controls and the prioritization of the projects and operational tasks of our cybersecurity teams.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: Our approach to controlling these risks is designed and assessed based on our selection and implementation of certain controls from the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. These controls are implemented to help us identify our critical assets and systems, protect them through preventative measures, detect attempts to compromise their confidentiality, integrity, and availability, respond to attacks by containing their progression and notifying relevant parties, and recover effectively if successfully compromised.


text: Key elements of our cybersecurity risk management program include but are not limited to: authentication and authorization procedures, employee security awareness training, logging and monitoring procedures, network segmentation requirements, in transit and at rest encryption of certain data we deem sensitive, periodic vulnerability scanning, periodic control validation through penetration testing, periodic phishing attack simulations, production change control requirements, periodic tabletop exercises, and written incident response plans. We also use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes.


text: To date, we are not aware of any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Fluence. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information on potential cybersecurity risks, please see Part I, Item 1A "Risk Factors" for the risk factor entitled "Our business depends on our ability to implement improvements to and properly maintain and protect the continuous operation and data integrity of our information technology infrastructure and other business systems and the inability to do so may have a material adverse effect on our reputation and harm our business prospects, financial conditions, and operating results."


text: Our cybersecurity program and supporting ISMS are governed by our Cybersecurity Steering Committee, which is chaired by our Chief Information Security Officer ("CISO") and is comprised of other members of our management team, including individuals from our finance, supply chain, product, information technology ("IT"), and legal departments. The Cybersecurity Steering Committee convenes quarterly to review the ISMS, identify new material risks and potential treatment plans that are recorded in our cybersecurity risk register, and review the overall health of security key risk indicators, technical key performance indicators, and roadmaps for the expected delivery of new and updated controls.


text: Our CISO, in coordination with our Chief Information Officer ("CIO") to whom the CISO reports, leads our approach to assessing and managing cybersecurity-related risks. Our CISO has over thirty years of experience in IT, with twenty years in information security, as well as a background in software engineering and in leading security engineering teams, technical services and support teams, and sales engineering teams. Our CIO has over 20 years of experience with information technology and cyber security and a background in software engineering. Our CIO has served in lead cyber security roles at global public companies and holds a CISA certification from the Information Systems Audit and Control Association.


text: We have a written cybersecurity incident escalation process overseen by senior leadership, and when senior leadership deems appropriate, a materiality committee is convened comprised of certain members of management who assess whether incidents must be reported to the SEC and/or the appropriate authorities.


text: While Fluence's board of directors oversees all enterprise risks, the Audit Committee of our board of directors has primary responsibility for overseeing cybersecurity risks and management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly updates from the CISO and CIO. These updates typically cover topics such as: overview of material cybersecurity incidents that have occurred since the last update, overview of residual cybersecurity risks to our critical business assets, recent investments in our cybersecurity program, and relevant cybersecurity operational metrics. The Audit Committee will report material updates regarding cybersecurity to the Board.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Key elements of our cybersecurity risk management program include but are not limited to: authentication and authorization procedures, employee security awareness training, logging and monitoring procedures, network segmentation requirements, in transit and at rest encryption of certain data we deem sensitive, periodic vulnerability scanning, periodic control validation through penetration testing, periodic phishing attack simulations, production change control requirements, periodic tabletop exercises, and written incident response plans. We also use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. We maintain a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: To date, we are not aware of any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Fluence. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information on potential cybersecurity risks, please see Part I, Item 1A "Risk Factors" for the risk factor entitled "Our business depends on our ability to implement improvements to and properly maintain and protect the continuous operation and data integrity of our information technology infrastructure, data, and other business systems and the inability to do so may have a material adverse effect on our reputation and harm our business prospects, financial conditions, and operating results."


text: Our cybersecurity program and supporting ISMS are governed by our Cybersecurity Steering Committee, which is includes our Chief Information Officer ("CIO") and is comprised of other members of our management team, including individuals from our finance, supply chain, product, information technology ("IT"), and legal departments. The Cybersecurity Steering Committee convenes quarterly to review the ISMS, identify new material risks and potential treatment plans that are recorded in our cybersecurity risk register, and review the overall health of security key risk indicators, technical key performance indicators, and roadmaps for the expected delivery of new and updated controls.


text: Cybersecurity oversight and related risk-management activities are currently led by the CIO, who has more than 20 years of experience in information technology, cybersecurity governance, and enterprise-risk management. The CIO has implemented defense-in-depth cybersecurity frameworks and controls aligned with industry standards such as COBIT and ITIL and has regularly reported on cybersecurity risks and mitigation activities to boards of directors and audit committees throughout his career. Management is informed about cybersecurity risks through ongoing monitoring and reporting processes, including real-time incident dashboards, periodic risk assessments, and collaboration with internal and external cybersecurity experts. The CIO provides updates on cybersecurity risks, incident response readiness, and mitigation efforts to executive leadership and Fluence's board of directors through the Audit Committee as part of the Company's enterprise-risk-management program.


text: While Fluence's board of directors oversees all enterprise risks, the Audit Committee of our board of directors has primary responsibility for overseeing cybersecurity risks and management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly updates from CIO. These updates typically cover topics such as: overview of material cybersecurity incidents that have occurred since the last update, overview of residual cybersecurity risks to our critical business assets, recent investments in our cybersecurity program, and relevant cybersecurity operational metrics. The Audit Committee will report updates regarding cybersecurity to the Board, as it deems appropriate.


text: The operation, integrity and security of our systems and the security of our data and the data of our members, guests and employees is critical to us. We have therefore developed and maintain a cybersecurity program designed to safeguard our systems from unauthorized access and to protect the confidentiality, integrity and availability of our data and the data of our members, guests and employees from external and internal threats.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: We take a risk-based approach with our cybersecurity program that has been designed in accordance with the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our program focuses on a variety of potential material risks including operational (including unauthorized access), financial, reputational and compliance-related. We analyze these risks based on numerous factors and also weigh their likelihood and potential impact. This analysis is led by our Chief Digital Officer and Chief Information Security Officer as detailed below under "—Governance." Additionally, we have identified cybersecurity as a credible technology-related risk under our enterprise risk management ("ERM") program. Our Chief Digital Officer is the owner of our technology risks and is therefore charged with executing controls to monitor and mitigate cybersecurity risks through people, processes and technology. Our ERM Committee is comprised of Company leaders and meets at least quarterly to consider, among other matters, the effectiveness of the risk monitoring and mitigating and the expected frequency, severity and trend of our credible risks including cybersecurity.


text: We seek to continuously improve our program within the NIST framework based on our risk assessment as well as our business needs and industry trends. We also apply administrative, operational and technical security controls to handle and process our data and the data of our members, guests and employees in a responsible and secure manner, including through various internal policies and standards governing information security. We leverage the expertise and advice of third parties to conduct audits, assessments, tabletop exercises, penetration testing and other reviews to assist us in identifying and implementing improvements to our cybersecurity program and aligning it with the NIST framework and our overall ERM program.


text: Our cybersecurity program includes ongoing vulnerability and risk management processes along with a managed security service provider that utilizes a detection and response solution to provide us with 24/7/365 monitoring and alerting. We have developed an incident response plan that is designed in accordance with the NIST framework to facilitate (1) identification and containment of any cybersecurity incidents; (2) remediation of identified vulnerabilities; (3) mitigation of disruption to critical information systems; and (4) assessment of what occurred, notification of affected individuals as necessary and mitigation of consequences that may arise from any unauthorized access. This plan also identifies and describes the roles and responsibilities of our incident response team, including investigation and escalation as appropriate up to and including our Audit Committee or Board of Directors.


text: Our cybersecurity program also addresses risks associated with third-party service providers who may access or integrate with our systems and data. Our processes include having such third parties complete a cybersecurity questionnaire, agree to appropriate contractual obligations and provide annual evidence of their compliance where applicable.


text: While we experience cybersecurity threats during the normal course of business, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us and we do not believe are reasonably likely to materially affect us, including with respect to our business strategy, results of operations and financial condition.


text: Our Board of Directors oversees risk management of our business and accomplishes this oversight primarily through the Audit Committee. Our Audit Committee discusses the Company's policies with respect to risk assessment and risk management, including guidelines and policies to govern the process by which the Company's exposure to risk is handled. As part of this process, our Audit Committee oversees our ERM program including risks related to privacy, data and information security, including cybersecurity. Management presents to the Audit Committee at least annually on our cybersecurity program and risks related thereto, and then the Audit Committee reports on that presentation to our Board of Directors. The presentations may address (1) the current cybersecurity landscape and emerging threats; (2) the status of ongoing cybersecurity initiatives and strategies; (3) incident reports and learnings from any cybersecurity incidents; and/or (4) compliance with regulatory requirements and industry standards. In addition, our executive team may report specific cybersecurity incidents to the Audit Committee or Board of Directors outside of a regularly scheduled meeting based on the impact of the incident. Our internal escalation process is set forth in our incident response plan.


text: Our Executive Vice President and Chief Digital Officer is our executive team member responsible for our cybersecurity program and our Chief Information Security Officer ("CISO") leads the program. Together they provide updates to the ERM Committee and present to our Audit Committee at least annually. In addition, we have established an incident response team comprised of a cross-functional group of team members who manage our response to any cybersecurity incident pursuant to our incident response plan.


text: Our CISO has an undergraduate degree in Management Information Systems, decades of cybersecurity and technology experience and broad industry-wide experience, including in hospitality, retail, medical, energy and government. Members of our cybersecurity team have over 100 years of combined cybersecurity experience and hold professional certifications from security organization such as ISC2 and SANS Institute that include Certified Information Systems Security Professional (CISSP), GIAC Web Application Penetration Tester (GWAPT), GIAC Penetration Tester (GPEN), GIAC Certified Intrusion Analyst (GCIA) and GIAC Certified Forensic Analyst (GCFA). Our cybersecurity team also stays informed on the latest developments in cybersecurity, including trends, risks, threat vectors and attack mechanisms, through security and compliance-related seminars, conferences, continuing education training, news feeds and forums and our CISO sits on various CISO committees and roundtables. Our CISO's knowledge and experience, coupled with the expertise and advice we receive from third parties, are instrumental in assessing and managing our cybersecurity program, including our strategy, security engineering, security operations, cybersecurity awareness and training, information technology governance and compliance, and cyber threat identification, assessment, management, mitigation and response.


text: We take a risk-based approach with our cybersecurity program that has been designed in accordance with the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our program focuses on a variety of potential material risks including operational (including unauthorized access), financial, reputational and compliance-related. We analyze these risks based on numerous factors and also weigh their likelihood and potential impact. This analysis is led by our Chief Digital Officer and Chief Information Security Officer as detailed below under "—Governance." Additionally, we have identified cybersecurity as a credible technology-related risk under our enterprise risk management ("ERM") program. Our Chief Digital Officer is the owner of our technology risks and is therefore charged with executing controls to monitor and mitigate cybersecurity risks through people, processes and technology. Our ERM Committee is comprised of Company leaders who meet to consider, among other matters, the effectiveness of the risk monitoring and mitigating and the expected frequency, severity and trend of our credible risks including cybersecurity.


text: Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Technology Income Corp.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.