text: Board of Directors' Oversight of Risks from Cybersecurity Risks Cybersecurity risks are overseen by our full Board of Directors with input from the Audit Committee, which reviews the results of internal audit assessments and tests related to cybersecurity. As part of this oversight, the Board of Directors and the Audit Committee meet regularly to discuss the progress of ongoing initiatives and to seek coordination between enterprise stakeholders. At these meetings, our Chief Information Officer ("CIO"), who oversees the Company's cybersecurity program, along with key subject matter experts, as necessary, review current and emerging cybersecurity-related threats as well as key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance in countering these threats. Based on the information provided through these various processes, our Board of Directors evaluates the risks facing us and provides guidance to management on our risk management strategy.


text: The CIO, in collaboration with our Corporate Instruments and Control Systems Lead, and General Manager, Control Center Operations, are primarily responsible for assessing and managing our material risks from cybersecurity threats, monitoring the effectiveness of our cybersecurity detection and response processes in countering current threats and providing updates to our executive team.

companyName: HF Sinclair Corp

ticker: DINO

secItem: Item 1C


text: The CIO has over 30 years of combined accounting, financial consulting, IT and Committee of Sponsoring Organizations (referred to as COSO) risk-based operational, financial and IT auditing experience, and has had oversight over the Company's cybersecurity activities as CIO for more than five years. The Corporate Control Systems, Advanced Process Controls and Cybersecurity Lead has over 30 years of experience overseeing the Company's refining operational technology systems and serves as the Company's refining operational technology cybersecurity leader. The General Manager, Control Center Operations, has over 10 years of pipeline control systems experience and serves as the Company's midstream operational technology cybersecurity leader.


text: The CIO serves as Chair of the Company's management level Cyber Risk Committee, which provides oversight over the Company's strategy and controls to identify, manage and mitigate risks related to cybersecurity and incident response and resiliency associated with the Company's IT and OT environments, and is comprised of representatives from compliance, IT and OT cybersecurity, internal audit, legal and risk. The Chair of the Cyber Risk Committee reports to the Company's management level Risk Management Oversight Committee and the Board of Directors on a regular basis.


text: The Company has adopted multiple incident response plans that establish guidelines for responding to incidents that may compromise the confidentiality, integrity and availability of Company information and systems, including referring matters to the Company's Incident Response Team and, as appropriate, to the Chief Executive Officer and the Board of Directors for additional evaluation and oversight.


text: As of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect our Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. See Item 1A. "Risk Factors – Risks Related to Cybersecurity, Data Security, and Privacy, Information Technology and Intellectual Property" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks We are focusing on cybersecurity risk, particularly as our operations become increasingly dependent on digital technologies for controlling our plants and pipelines, processing transactions and summarizing and reporting results of operations. Globally, as cybersecurity incidents are occurring more often and using increasingly sophisticated methods, we are at risk for interruptions, outages and breaches of operational systems, including business, financial, accounting, product development, data processing or manufacturing processes, owned by us or our third-party vendors or suppliers, or data that we process or that our third-party service providers process on our behalf. Any such cyber incidents have the potential to materially disrupt or shut down operational systems; result in loss of, unauthorized access to, or copying or transfer of intellectual property assets, trade secrets or other proprietary or competitively sensitive information; compromise certain information of customers, employees, suppliers or others; and/or jeopardize the security of our facilities. We collect and store sensitive data in the ordinary course of our business, including certain personally identifiable information and proprietary business information for our business and our customers, suppliers, contractors, investors and other stakeholders. We also work with third-party service providers that may in the course of their business relationship with us collect, store, process and transmit such data on our behalf.


text: As further described in Item 1A. "Risk Factors – Risks Related to Cybersecurity, Data Security, and Privacy, Information Technology and Intellectual Property," the Department of Homeland Security's ("DHS") Transportation Safety Administration has issued a series of security directives that require us to take a number of actions, including among other things, to appoint personnel, report confirmed and potential cybersecurity incidents to the DHS Cybersecurity and Infrastructure Security Agency and provide vulnerability assessments. We have adopted a cybersecurity program, which uses technology and processes designed to help mitigate cybersecurity risks, with our information technology ("IT") and operational technology ("OT") teams working together to protect, identify, detect, mitigate and respond to potential cybersecurity incidents that threaten our Company. Our cybersecurity program includes a process for overseeing and identifying cybersecurity risks associated with our third-party service providers.


text: We have made efforts to implement the National Institute of Standards and Technology (NIST) Cybersecurity Framework as well as supplemental guidance for information and operational technologies. We seek to follow federal and state statutory and regulatory guidance and have adopted internal policies and standards designed to align with these requirements.


text: We regularly engage independent third-party security consultants to help assess and monitor our IT and OT environments for vulnerabilities, to conduct penetration testing and to recommend mitigation strategies. In addition, we use third-party tools for vulnerability scans to identify external and internal risks.


text: Each employee's and contractor's ability to recognize and report cybersecurity threats is an important component of our cybersecurity program. On an annual basis, all Company employees are required to complete cybersecurity training. In addition, we regularly utilize employee exercises and communications designed to reinforce key cybersecurity training messages.


text: The above cybersecurity risk management processes are integrated into our overall risk management program. In addition to our efforts to continually evaluate our cybersecurity program and cybersecurity risks based upon emerging threats as a part of our risk management processes, cybersecurity risks to the Company are evaluated periodically through internal audits and annually by independent consultants, and we seek to incorporate learnings into our overall risk matrices.


text: We continue to make investments in new cybersecurity technologies to protect our facilities, users, and stakeholders, and to protect the personally identifiable information we maintain.


text: Board of Directors' Oversight of Risks from Cybersecurity Risks Cybersecurity risks are overseen by our full Board of Directors with input from the Audit Committee, which reviews the results of internal audit assessments and tests related to cybersecurity. As part of this oversight, the Board of Directors and the Audit Committee meet regularly to discuss the progress of ongoing initiatives and to seek coordination between enterprise stakeholders. At these meetings, our Chief Information Officer ("CIO"), who oversees the Company's cybersecurity program, along with the Chief Information Security Officer ("CISO") and key subject matter experts, as necessary, review current and emerging cybersecurity-related threats as well as key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance in countering these threats. Based on the information provided through these various processes, our Board of Directors evaluates the risks facing us and provides guidance to management on our risk management strategy.


text: Table of Content s Management's Role in Assessing and Managing Cybersecurity Risks The CIO, in collaboration with our CISO, and other key leaders across HF Sinclair operations, are primarily responsible for assessing and managing our material risks from cybersecurity threats, monitoring the effectiveness of our cybersecurity detection and response processes in countering current threats and providing updates to our executive team.


text: The CIO has over 25 years of Information Technology experience, 20 of those years leading large programs within the Oil & Gas industry, including mergers and acquisitions, cybersecurity, digital transformation. The CISO also brings over 30 years of Information Technology experience, with almost 20 years of Oil & Gas experience which includes IT & OT Cybersecurity and technology infrastructure.


text: The CIO serves as Chair of the Company's management level Cyber Risk Committee, which provides oversight over the Company's strategy and controls to identify, manage and mitigate risks related to cybersecurity and incident response and resiliency associated with the Company's IT and OT environments, and is comprised of representatives from compliance, IT and OT cybersecurity, internal audit, legal and risk. The Chair of the Cyber Risk Committee reports to the Company's management level Risk Management Oversight Committee on a regular basis and both the Chair of the Cyber Risk Committee and the CISO report to the Board of Directors on a regular basis.


text: As of the date of this Annual Report on Form 10-K, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect our Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. "Risk Factors – Risks Related to Cybersecurity, Data Security, and Privacy, Information Technology and Intellectual Property" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: At Vista Credit Strategic Lending Corp., we recognize the importance of assessing, identifying and managing risks associated with cybersecurity threats. These risks include operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws, and other litigation and legal, financial and reputational risks.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: We rely on the cybersecurity strategy and policies implemented by Vista, the parent of our Adviser. Vista maintains, and we rely on, a comprehensive cybersecurity program that is aligned to the National Institute of Standards and Technology's Cybersecurity Framework as part of its enterprise risk management program, including physical and digital technologies and administrative, operational, and technical controls, to aid in efforts to identify, assess and manage cybersecurity risks. The program is designed to provide for the availability of critical data and systems, maintain regulatory compliance, manage material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents. Among other things, the program includes a risk management framework; controls designed to monitor our digital infrastructure and detect and alert to suspicious, anomalous, and/or malicious behavior and indicators of potential cybersecurity threats; regular scanning of our networks and systems to triage and manage any potentially exploitable vulnerabilities; regular tabletop exercises to test our incident response and business continuity and disaster recovery preparedness; and annual Information Security Awareness training for employees.


text: Vista has an Incident Response Plan which guides the actions to be taken in the event of a suspected or confirmed cybersecurity incident. The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable compliance with applicable legal and regulatory obligations and mitigation of financial and reputational damage. The Incident Response Plan includes notification to the applicable members of cybersecurity leadership, including Vista's Chief Information Security Officer ("Vista CISO"), and, as appropriate, escalation to an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on the nature of the incident, the incident may also be reported to Vista's Executive Committee, as well as to our Audit Committee and to our full Board, if appropriate. Vista also maintains a Business Continuity Plan, which provides procedures for maintaining the continuity of critical business processes in the event of business interruption, including any that involve cybersecurity incidents which may materially impact operations.


text: Vista engages with independent assessors and other third parties to validate security controls, standards, and policies, conduct annual penetration tests of networks and systems to identify threats and vulnerabilities, and assist with forensic analysis of material cybersecurity incidents. In addition, to identify and assess material risks from cybersecurity threats, Vista's enterprise risk professionals collaborate with subject matter specialists, the Vista CISO, and Vista's Chief Compliance Officer ("Vista CCO"), Vista's Chief Operating Officer and Vista's Chief Legal Officer, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.


text: These processes are also designed to address cybersecurity threats associated with the use of third-party providers. When selecting third-party service providers, associated cybersecurity threats are assessed, and, in addition, ongoing cybersecurity risk assessments of third-party service providers are conducted. These third-party service providers are also required to provide notifications of material breaches that may impact Vista's data. Vista incorporates the cybersecurity risk coordination and assessment of third-party service providers into the overall cybersecurity program and enterprise-wide risk management.


text: We are not aware of any material cybersecurity incidents that have impacted us. However, Vista is aware that similar institutions, as well as its employees, service providers and other third parties, have experienced a significant increase in information security and cybersecurity threats in recent years and will likely continue to be the targets of increasingly sophisticated cyber-attacks. We described whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy and results of operations, under the heading "We are dependent on information systems and systems failures could significantly disrupt our business, which may, in turn, negatively affect our liquidity, financial condition or results of operations", included in Item 1A of this Form 10-K, which is incorporated by reference herein.


text: Cybersecurity is an important part of Vista's enterprise risk management processes and an area of focus for the Board of Directors and management for both Vista and us. These cybersecurity risk management and strategy processes are overseen by the Data Privacy and Information Risk Committee (the "DPIRC"). The DPIRC is co-chaired by the Vista CCO and Vista's Chief Information Officer, with members including the Vista CISO and senior representatives from Vista's Information Security, Legal, and Human Resources departments. The Vista CISO has extensive experience in cybersecurity and technology. The Vista CISO was appointed in 2024 and has over 20 years of cybersecurity, information security, and technology services and innovation experience.


text: The DPIRC is responsible for implementing, reviewing and revising cybersecurity policies and directives, as well as overseeing the protection, detection and response capabilities of cybersecurity resources. In addition, the DPIRC promotes, endorses and validates Vista's cybersecurity risk posture, reviews industry best-practices, provides strategic direction for cybersecurity matters and oversees cybersecurity training programs. The DPIRC is informed about and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, Vista's cybersecurity risk program and the operation of the Incident Response Plan and Business Continuity Plan and works in coordination with Vista's internal information technology departments to, among other things, implement, review and revise the policies underlying its cybersecurity program. Additionally, Vista's Enterprise Risk Committee receives quarterly information security updates from the Vista CISO.


text: The Board is responsible for the oversight of risks, including from cybersecurity threats. At least annually, the Vista CISO provides the Board with an overview of Vista's cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and the Incident Response Plan, as well as the steps taken to respond to such risks. Material cybersecurity threat risks are also considered during Board meeting discussions of matters such as enterprise risk management, operational budgeting, business continuity planning, brand management and other relevant matters.


text: Our management and board of directors (the "Board") recognize the importance of maintaining the capacity, reliability and security of our information technology environment and data security infrastructure to deliver on the expectations, and maintain the trust and confidence, of our customers, clients, business partners, employees and investors. The Board is actively involved in our risk management practices, including oversight of our overall enterprise risk management ("ERM") framework, in which cybersecurity risk management is reviewed by the board at least on an annual basis. Our cybersecurity and privacy programs align with the recognized frameworks established by the National Institute of Standards and Technology and leverage the International Organization for Standardization and other applicable industry standards. The focus of our cybersecurity program is preserving the confidentiality, security and availability of our systems and data, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: We have established and implemented processes to assess, identify and manage material cybersecurity risks. Cybersecurity risks are assessed, identified and managed by our Director of Global Cybersecurity, with direct supervision by our Chief Information Officer ("CIO") and with the assistance of our internal audit and legal teams. Our Director of Global Cybersecurity shares information regarding such risks with our management's senior level information security council (the "Information Security Council"), which consists of our CIO, Chief Financial Officer, Chief Technical Officer, Chief Legal Officer & Corporate Secretary, Vice President of Strategy and Director of Internal Audit & Enterprise Risk Management, and which supports the Audit Committee's oversight of cybersecurity risk, including by providing regular reports on various cybersecurity matters. We have in place robust physical, technical, administrative, and organizational controls for the securing of our information systems.


text: We maintain a comprehensive, risk-based, third-party risk management process to identify, assess and manage cybersecurity risks associated with third-party service providers. Third-party service providers undergo thorough pre-engagement due diligence, including security and privacy assessments. All service providers are required to enter into contracts containing security and data processing terms no less stringent than those employed by us in safeguarding our own data. Any third-party service providers with access to confidential or sensitive data are subject to ongoing oversight activities, including assessments and audits, throughout the lifetime of the engagement.


text: Additionally, we maintain a comprehensive incident response plan (the "Incident Response Plan"), which establishes a comprehensive, effective and repeatable process for identifying, escalating and responding to cybersecurity incidents. We test and evaluate the Incident Response Plan, including contingency and recovery plans, on a regular basis, and we develop, implement and review contingency and recovery plans for information systems, both internal and vendor managed. The results of such assessments drive changes and enhancements to governance, policies, procedures, technologies and partner decisions to continuously monitor and improve our cybersecurity risk management. The Information Security Council practiced the procedures of the Incident Response Plan through a tabletop exercise facilitated by external consultants in October 2023, and a similar exercise is planned for the Board during 2024. We also leverage third-party support, including vendors, consultants and assessors, to analyze risk exposure, to identify remediation opportunities and to reduce our overall cybersecurity risk.


text: Previous cybersecurity incidents have not materially affected us, including our business strategy, financial condition, results of operations or cash flows. However, risks from cybersecurity threats, including but not limited to security breaches, computer malware, ransom attacks, other cyber-attacks, or other similar threats may materially affect us, including our business, financial condition, results of operations or cash flows.


text: The Board oversees the Company's overall ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee is responsible for overseeing our risk exposure to information security, cybersecurity and data protection, as well as the steps management has taken to monitor and control such exposures, and regularly provides reports to the Board on cybersecurity risk management. The Audit Committee Charter was amended in October 2023 to explicitly set forth the Audit Committee's responsibility for such oversight. The Audit Committee receives regular presentations and reports from our Director of Global Cybersecurity and our CIO on cybersecurity risks and prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds. Our Information Security Council also report to the Board at least annually on data protection and current internal and external developments in cybersecurity, as part of the Board's enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.


text: Our Global Cybersecurity Operations function is a global team led by our Director of Global Cybersecurity, who reports to our CIO. In turn, our CIO reports to our Chief Executive Officer. The Information Security Council provides additional oversight for assessing and managing cybersecurity risk.


text: Our Director of Global Cybersecurity has over 15 years of cybersecurity and information technology experience, including as Director of Cybersecurity for various institutions. Our Director of Global Cybersecurity has a Bachelor of Science in Information Science and Technology and a master's degree in information sciences, cybersecurity and information assurance, and he has a Certified Information Systems Security Professional certification, a GIAC Information Security Professional certification and a CompTIA Network+ ce certification. Our CIO has over 25 years of cybersecurity and information technology experience, including serving in the information technology function at Cummins Inc., where she served as the information technology leader in Cummins Filtration Inc., and as a programmer, analyst and information technology architect. Our CIO holds an undergraduate degree in business administration with emphasis in management information systems. Our Chief Financial Officer, Chief Technical Officer, Chief Legal Officer, VP of Vice President of Strategy and Director of Internal Audit & Enterprise Risk Management each have relevant educational and industry experience, including managing risks at our Company and at similar companies, including risks arising from cybersecurity threats.


text: Our management and board of directors (the "Board") recognize the importance of maintaining the capacity, reliability and security of our information technology environment and data security infrastructure to deliver on the expectations, and maintain the trust and confidence, of our customers, clients, business partners, employees and investors. The Board is actively involved in our risk management practices, including oversight of our overall enterprise risk management ("ERM") framework, in which cybersecurity risk management is reviewed by the Board on at least an annual basis. Our cybersecurity and privacy programs align with the recognized frameworks established by the National Institute of Standards and Technology and leverage the International Organization for Standardization and other applicable industry standards. The focus of our cybersecurity program is preserving the confidentiality, security and availability of our systems and data, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: We have established and implemented processes to assess, identify and manage material cybersecurity risks. Cybersecurity risks are assessed, identified, and managed by our Executive Director of Cybersecurity and Infrastructure, with direct supervision by our Vice President and Chief Information Officer ("CIO") and with the assistance of our internal audit and legal teams. Our Executive Director of Cybersecurity and Infrastructure shares information regarding such risks with our management's senior level information security council (the "Information Security Council"), which consists of our CIO, Senior Vice President and Chief Financial Officer, Vice President and Chief Technical Officer, Senior Vice President and Chief Legal Officer & Corporate Secretary (currently vacant), Vice President of Strategy and Director of Internal Audit & Enterprise Risk Management, and which supports the Audit Committee's oversight of cybersecurity risk, including by providing regular reports on various cybersecurity matters. We have in place robust physical, technical, administrative, and organizational controls for the securing of our information systems.


text: We maintain a comprehensive, risk-based, third-party risk management process to identify, assess and manage cybersecurity risks associated with third-party service providers. Third-party service providers undergo thorough pre-engagement due diligence, including security and privacy assessments. All contracts with such third-party service providers are required to contain security and data processing terms no less stringent than those employed by us in safeguarding our own data. Any third-party service providers with access to confidential or sensitive data are subject to ongoing oversight activities, including assessments and audits, throughout the lifetime of the engagement.


text: Additionally, we maintain an incident response plan (the "Incident Response Plan"), which establishes a comprehensive, effective, and repeatable process for identifying, escalating and responding to cybersecurity incidents. We test and evaluate the Incident Response Plan, including contingency and recovery plans, on a regular basis, and we develop, implement and review contingency and recovery plans for information systems, both internal and vendor managed. The results of such assessments drive changes and enhancements to governance, policies, procedures, technologies, and partner decisions to continuously monitor and improve our cybersecurity risk management. The Information Security Council practices the procedures of the Incident Response Plan through tabletop exercises facilitated by external consultants. We also leverage third-party support, including vendors, consultants, and assessors, to analyze risk exposure, to identify remediation opportunities and to reduce our overall cybersecurity risk.


text: The Board oversees the Company's overall ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures, and regularly provides reports to the Board on cybersecurity risk management. The Audit Committee Charter explicitly sets forth the Audit Committee's responsibility for such oversight. The Audit Committee receives regular presentations and reports from our Executive Director of Cybersecurity and Infrastructure and our CIO on cybersecurity risks and prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds. Our Executive Director of Cybersecurity and Infrastructure and our CIO also report to the Board at least annually and to Audit Committee at least quarterly on current internal and external developments in cybersecurity, as part of the Board's enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.


text: Our Global Cybersecurity Operations function is a global team led by our Executive Director of Cybersecurity and Infrastructure, who reports to our CIO. In turn, our CIO reports to our Chief Executive Officer. The Information Security Council provides additional oversight for assessing and managing cybersecurity risk.


text: Our Executive Director of Cybersecurity and Infrastructure has over 15 years of cybersecurity and information technology experience, including as Director of Cybersecurity for various institutions. Our Executive Director of Cybersecurity and Infrastructure has a Bachelor of Science in Information Science and Technology and a master's degree in information sciences, cybersecurity, and information assurance, and he has a Certified Information Systems Security Professional certification, a GIAC Information Security Professional certification and a CompTIA Network+ ce certification. Our CIO has over 25 years of information technology experience, including serving in the information technology function at Cummins Inc., where she served as the information technology leader for Cummins Filtration Inc. Our CIO holds an undergraduate degree in business administration with emphasis in management information systems. Each of the other members of the Information Security Council have relevant educational and industry experience, including managing risks at our Company and at similar companies.


text: We rely on the cybersecurity policies and procedures implemented by New Mountain Capital. New Mountain Capital has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to New Mountain Capital's Information Security Program, the New Mountain Capital Information Technology Steering Committee ("ITSC") is responsible for the development, evolution, and implementation of policies and technical measures to reasonably prevent security incidents. At times New Mountain Capital may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: New Mountain Guardian IV BDC, L.L.C.


text: New Mountain Capital uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, New Mountain Capital uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, New Mountain Capital also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected. New Mountain Capital also requires that all employees, including employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A.–Risk Factors–Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above.


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of directors on developments to the information security and cybersecurity risks we face. Reports include, among other things, an overview of New Mountain Capital's controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us.


text: We recognize the importance of implementing and maintaining measures to safeguard our information technology systems and data. We and the Manager have entered into agreements with third parties for hardware, software, telecommunications and other information technology services in connection with our business. In addition, we and the Manager have developed or may develop proprietary software systems, management techniques and other information technologies incorporating software licensed from third parties. The Company integrates cybersecurity risks into its overall enterprise risk management program. Pursuant to the MSA, the Manager provides us with back-office services, including services for the management of our data and cybersecurity risk. Together with the Manager, we seek to assess, identify, and manage cybersecurity risks with the help of independent cybersecurity services as follows: (i) we have a multi-layered system designed to protect and monitor data and cybersecurity risk, which includes the use of firewalls and protection software, and an independent cybersecurity vendor regularly assesses our cybersecurity safeguards and updates our cybersecurity infrastructure, procedures, policies, and education programs, as appropriate; (ii) we have monitoring and detection systems designed to identify cybersecurity incidents, and we have an incident response plan designed to provide action to contain cybersecurity incidents, mitigate their impact, and restore our normal operations; (iii) we require our employees and contractors to receive annual cybersecurity awareness training and incident response plan training; and (iv) we have access controls designed to provide users of the systems containing our data with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions.

companyName: Granite Ridge Resources, Inc.

ticker: GRNT


text: The Manager engages an independent cybersecurity vendor to review, assess, and make recommendations regarding our information security program and information technology strategic plan. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, before engaging with any third-party cybersecurity service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to require third-party service providers with access to personally identifiable information to adhere to our security standards and protocols.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, though the Company and our service provider have experienced certain minor cybersecurity incidents, we are not aware of any previous cybersecurity threats or incidents that may have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Board of Directors' Oversight and Management's Role The Board of Directors has primary oversight of risks from cybersecurity threats and recognizes the importance of cybersecurity to the success and resilience of our business. The Board of Directors delegates oversight of our enterprise risk management process, including review of cybersecurity and data protection and compliance with cybersecurity policies, to the Audit Committee. An employee of the Manager is responsible for day to day oversight of our cybersecurity risks and management of our cybersecurity vendor, and that employee escalates higher business cybersecurity risks to the Audit Committee or the Board as appropriate.


text: Company management meets as needed with relevant employees of the Manager to discuss cybersecurity risks and incident trends and escalates them, as appropriate, to the Audit Committee.


text: We and the Manager engage an independent cybersecurity vendor to review, assess, and make recommendations regarding our information security program and information technology strategic plan. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, before engaging with any third-party cybersecurity service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to require third-party service providers with access to personally identifiable information to adhere to our security standards and protocols.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our or our operators' information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our or our operators' information and operational technology systems.


text: Board of Directors' Oversight and Management's Role The Board of Directors has primary oversight of risks from cybersecurity threats and recognizes the importance of cybersecurity to the success and resilience of our business. The Board of Directors delegates oversight of our enterprise risk management process, including review of cybersecurity and data protection and compliance with cybersecurity policies, to the Audit Committee. An employee of the Manager is responsible for day to day oversight of our cybersecurity risks and management of our cybersecurity vendor, and that employee escalates cybersecurity risks to the Audit Committee or the Board as appropriate.


text: Company management, including our Chief Financial Officer, meets as needed with relevant employees of the Manager, who collectively have over ten years of experience in managing cybersecurity related issues on behalf of the Manager, to discuss cybersecurity risks and incident trends and escalate them, as appropriate, to the Audit Committee.


text: Our information security program is managed by our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), who are responsible for assessing, monitoring and managing our cybersecurity risks. Our CIO has over 30 years of experience in the technology field, and our CISO has over 20 years of experience in the technology and cybersecurity fields, including over 10 years of experience as a CISO or Head of Information Security for various organizations.

companyName: RXO, Inc.

ticker: RXO


text: Our cybersecurity risk management and identification has been integrated into our broader enterprise risk management framework which is regularly reported on to the Audit Committee of our Board of Directors. Additionally, our CIO and CISO provide periodic reports to our Board of Directors, as well as to our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cybersecurity risks and threats, the status of activities to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: We also engage with various external experts, including cybersecurity assessors and consultants, to conduct cybersecurity program and threat assessments and to advise management on ways to enhance our cybersecurity program as part of our continuing efforts to evaluate the effectiveness of our information security program. We utilize certain third-party service providers to perform a variety of functions to operate our business and we seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity of the information, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, and conducting security assessments.


text: While we have not experienced a cybersecurity incident that has materially affected our business, results of operations or financial condition, see the risk factor entitled "We could be affected by cyberattacks or breaches of our information systems, any of which could have a material adverse effect on our business" in Item 1A — Risk Factors for information about the cybersecurity risks we face.


text: We are a blank check company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable target businesses for a business combination. Therefore, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting, monitoring and detection tools and anti-virus software in. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with. We may also consider in the future whether to engage an assessor(s), consultant(s), auditor(s) or other third party(s) to supplement our processes.

companyName: Battery Future Acquisition Corp.


text: To date, we have not experienced any cybersecurity attacks. However, any such attack could adversely affect our business. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.


text: The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our management team on various potential cybersecurity matters, including areas of emerging risks, incidents and industry trends, and other areas of importance.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk.

companyName: Horizon Space Acquisition I Corp.

ticker: HSPOF


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our board of directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the board deems appropriate to take. As of the date of this report, we have not encountered any cybersecurity incidents since our IPO.


companyName: Bukit Jalil Global Acquisition 1 Ltd.


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate a Business Combination. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Tristar Acquisition I Corp.


companyName: Horizon Space Acquisition II Corp.

ticker: HSPT


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of GC Advisors and other third-party service providers. GC Advisors manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Golub Capital Private Credit Fund


text: Cybersecurity Program Overview GC Advisors has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. GC Advisors' cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. GC Advisors actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on GC Advisors to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on GC Advisors' risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of GC Advisors when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: Board Oversight of Cybersecurity Risks The board of trustees provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The board of trustees receives periodic updates from the Company's Chief Financial Officer ("CFO") and Chief Compliance Officer ("CCO") regarding the overall state of GC Advisors' cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management GC Advisors' internal cybersecurity team, headed by GC Advisors' Chief Information Officer ("CIO"), are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes), and along with the Company's CCO and a Disclosure Committee that is headed by the Company's CFO (the "Disclosure Committee"), are responsible for assessing and managing material risks from cybersecurity threats that impact the Company.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company since the Company commenced operations on June 30, 2023 and has worked in the financial services industry for more than eighteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function as CCO to the Company since the Company commenced operations on June 30, 2023 and has worked in the financial services industry for more than twenty years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. The Advisors' CIO has been responsible for her function for over four years and has worked in the financial services industry for more than fifteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company, including the CCO and the Company's Disclosure Committee, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of GC Advisors.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on a regular basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company since the Company commenced operations on June 30, 2023 and has worked in the financial services industry for more than nineteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function since assuming her role as CCO to the Company and has worked in the financial services industry for more than 15 years, during which time the CCO has gained expertise in assessing and managing risk, including those applicable to the Company. The Advisors' CIO has been responsible for her function for over five years and has worked in the financial services industry for more than sixteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.


text: The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser, as an affiliate of FS Investments. The Company also relies on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including the Company and its operations.

companyName: KKR FS Income Trust


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves, inter alia, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on FS Investments to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company is also included in the FS Investments risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of FS Investments' third-party risk management, legal, information technology, and compliance personnel of the Adviser and FS Investments, including the Chief Information Security Officer, or the CISO, of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The audit committee of the Board of Trustees of the Company, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and the Company's Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over ten years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since its inception in 2022 and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser and FS Investments.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: GE HealthCare employs practices, processes, and procedures to proactively and comprehensively manage risks, including risks related to cybersecurity, through its enterprise risk management ("ERM") program. We aim to identify material cybersecurity risks via multiple strategies, including user and external reporting, audit and assessment activities, and technology programs. We utilize risk identification and risk mitigation strategies.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: • Risk identification begins with understanding the devices and equipment in use across the company, including laptops and other data devices, industrial equipment and machinery, and associated risks related to the use of those devices and equipment. • Risk mitigation entails protecting our data and operational systems via a system of controls. We monitor and collect data about the devices and users that touch our network resources, reviewing this data for anomalies. When we identify anomalies, we investigate to determine if the anomaly represents a threat. We have a process to contain and remediate identified threats. As discussed further below, we have incident response processes in place to utilize in case of threats or incidents. We conduct regular crisis simulations.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our ERM assessment program as well as our cybersecurity-specific risk identification program, as discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data, or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence.


text: We have a dedicated team of cyber professionals who report to our Chief Information Security Officer ("CISO"). This team publishes information technology and security policies, measures compliance, and operates a program to mitigate risks and threats. Our risk mitigation activities include network segmentation, cyber protection and containment, detection and reaction, and recovery. This team operates to decrease the risk of cyber incidents having a material impact. We measure our programs against the National Institute of Standards and Technology Cyber Security Framework and regularly test our controls and incident response plans.


text: We maintain incident response plans that guide our activities in preparing for, detecting, responding to, and recovering from cybersecurity incidents. These plans cover the range of activities we undertake in connection with responding to cybersecurity incidents, including assessment, investigation, containment, remediation, and mitigation, as well as compliance with legal obligations including any necessary regulatory reporting.


text: As part of these processes, we regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: We describe whether and how cybersecurity-related risks could materially affect our business under the heading "Increased cybersecurity requirements, vulnerabilities, threats, and more sophisticated and targeted computer crimes pose a risk to our systems, networks, products, solutions, services, and data, as well as our reputation, which could adversely affect our business" under Item 1A. "Risk Factors." CYBERSECURITY GOVERNANCE.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit Committee of our Board is responsible for the oversight of cybersecurity-related risks. The Audit Committee regularly receives reports from management on our cybersecurity threat risk management and strategy processes, including on topics such as our data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, incident response plans, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks. The Audit Committee received reports from our Chief Information Officer ("CIO") and/or CISO four times in 2023.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO. The CISO works closely with the CIO, Chief Privacy Officer ("CPO"), and other members of the legal team who report to the General Counsel to review the cybersecurity program while monitoring global data protection regulations and cyber security laws. The CISO, CIO, and CPO, collectively, have over 35 years of work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Our CISO is currently a board member for the National Technology Security Coalition, a non-profit, non-partisan trade association serving as the voice of CISOs to help improve national cybersecurity and has served on the board of advisors of many security technology companies.


text: To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company, including its business strategy, results of operations, or financial condition. However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. We describe whether and how cybersecurity-related risks could materially affect our business in item 1A. "Risk Factors" under the heading "Increased cybersecurity requirements, vulnerabilities, threats, and more sophisticated and targeted cyber crimes pose a risk to our systems, networks, products, solutions, services, and data, as well as our reputation, which could adversely affect our business." CYBERSECURITY GOVERNANCE.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit Committee of our Board is responsible for the oversight of cybersecurity-related risks. The Audit Committee regularly receives reports from management on our cybersecurity threat risk management and strategy processes, including on topics such as our data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, incident response plans, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks. The Audit Committee received reports from our Chief Information Officer ("CIO") and/or CISO five times in 2024.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO. The CISO works closely with the CIO, Chief Privacy Officer ("CPO"), and other members of the legal team who report to the General Counsel, to review the cybersecurity program while monitoring global data protection regulations and cyber security laws. The CISO, CIO, and CPO, collectively, have over 35 years of work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Our CISO is currently a board member for the National Technology Security Coalition, a non-profit, non-partisan trade association serving as the voice of CISOs to help improve national cybersecurity and has served on the board of advisors of many security technology companies.


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our measures to prevent, detect and mitigate cyber threats include training for employees, multi-factor authentication, backup servers, threat monitoring, periodic strategy review and penetration testing performed by a third-party advisory firm, and coverage under an information security risk insurance policy. Third-party suppliers are pre-screened as part of our vendor onboarding process to evaluate their cybersecurity programs and assess risk. As a part of our pre-screening process, we evaluate each vendor's overall cybersecurity risk profile relative to the services they provide for Biohaven, including questions relating to cybersecurity insurance, security operations and access and management of our data. Cybersecurity incidents involving third-party supplier systems are evaluated for their impact on the Company and managed through our cyber incident management process. In addition, our employees are required to complete an annual cybersecurity training managed through our internal compliance training system.

companyName: Biohaven Ltd.

ticker: BHVN


text: The Board recognizes the importance of cybersecurity in maintaining the trust and confidence of our stakeholders, patients and employees. Our Audit Committee is central to the Board's oversight of cybersecurity and bears the primary responsibility for overseeing risks associated with our information systems and technology, including cybersecurity.


text: Our Chief Technology Officer ("CTO") is tasked with updating the Board and Audit Committee on cybersecurity risks. Our CTO provides comprehensive briefings to our Audit Committee on a quarterly basis regarding our strategy for managing and mitigating cybersecurity and technology-related risks. Beginning in 2024, our CTO will also provide such comprehensive briefings to the Board on an annual basis. Our CTO has been in the position for over three years and has over 35 years of industry experience focusing on large scale business transformations leveraging technology, cybersecurity, and technical operations excellence. Our CTO has held various senior technology leadership roles at other companies prior to joining the Company.


text: Cybersecurity Risks Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we are subject to various cybersecurity risks, which could, in the future, be material. For more information about the cybersecurity risks we face, see risk factor entitled "Our business and operations may be materially adversely affected in the event of computer system failures or security breaches" in Item 1A, "Risk Factors."


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology Cybersecurity Framework. Our measures to prevent, detect and mitigate cyber threats include training for employees, multi-factor authentication, backup servers, threat monitoring, periodic strategy review and penetration testing performed by a third-party advisory firm, and coverage under an information security risk insurance policy. Third-party suppliers are pre-screened as part of our vendor onboarding process to evaluate their cybersecurity programs and assess risk. As a part of our pre-screening process, we evaluate each vendor's overall cybersecurity risk profile relative to the services they provide for the Company, including questions relating to cybersecurity insurance, security operations and access and management of our data. Cybersecurity incidents involving third-party supplier systems are evaluated for their impact on the Company and managed through our cyber incident management process. In addition, our employees are required to complete an annual cybersecurity training managed through our internal compliance training system.


text: Our Chief Technology Officer ("CTO") is tasked with updating the Board and Audit Committee on cybersecurity risks. Our CTO provides comprehensive briefings to our Audit Committee on a quarterly basis regarding our strategy for managing and mitigating cybersecurity and technology-related risks. Our CTO also provides such comprehensive briefings to the Board on an annual basis. Our CTO has been in the position for over four years and has over three decades of industry experience focusing on large scale business transformations leveraging technology, cybersecurity, and technical operations excellence. Our CTO has held various senior technology leadership roles at other companies prior to joining the Company.


text: Cybersecurity Risks Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we are subject to various cybersecurity risks, which could, in the future, be material. For more information about the cybersecurity risks we face, see the risk factor entitled "Our business and operations may be materially adversely affected in the event of computer system failures or security breaches" in Item 1A, "Risk Factors."


text: Our board of directors is responsible for overseeing our risk management program, and cybersecurity is a critical element that has been integrated into our overall risk management program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices.

companyName: Zymeworks Inc.

ticker: ZYME


text: We aim to incorporate industry practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage cybersecurity risks. Our cybersecurity program is informed by applicable industry standards and is assessed regularly by independent third-party auditors.


text: Our cybersecurity risk management strategy focuses on several areas: • Identification and Escalation: We have implemented a cross-functional approach to assessing, identifying and managing cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We have established and maintain incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. We conduct periodic tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. We adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. We, like any company operating in the current environment, have experienced cybersecurity incidents in the past. However, we have not experienced a cybersecurity event that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors", of this Annual Report on Form 10-K, including the risk factor titled "Security breaches and incidents, loss of data and other disruptions could compromise sensitive information related to our business or protected health information or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Our board of directors, in coordination with the audit committee of our board of directors, oversees our risk management program, including the management of cybersecurity threats. Our board of directors and our audit committee receive prompt and timely information regarding cybersecurity risks, as well as ongoing updates regarding any such risk, from senior management.


text: Our Senior Director, IT who has over 20 years' experience with cybersecurity at public companies, in coordination with senior management including our Chief Executive Officer, works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, a cross-functional team throughout our company addresses cybersecurity threats and responds to cybersecurity incidents. Through ongoing communications with this team, the Senior Director, IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Our cybersecurity risk management strategy focuses on several areas: • Identification and Escalation: We have implemented a cross-functional approach to assessing, identifying and managing cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits. • Incident Response and Recovery Planning: We have established and maintain an incident response plan and a business continuity and disaster recovery plan designed to address our response to a cybersecurity incident. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.


text: We, like any company operating in the current environment, have experienced cybersecurity incidents in the past. However, we have not experienced a cybersecurity event that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors", of this Annual Report on Form 10-K, including the risk factor titled "Security breaches and incidents, loss of data and other disruptions could compromise sensitive information related to our business or protected health information or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Our Vice President of Information Technology and Facilities, who has over 20 years' experience with cybersecurity at public companies, in coordination with senior management including our Executive Vice President, Chief Business and Financial Officer, works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, a cross-functional team throughout our company addresses cybersecurity threats and responds to cybersecurity incidents. Through ongoing communications with this team, the Vice President of Information Technology and Facilities and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Cybersecurity at our company is overseen by our Board, the Audit Committee and management, as well as through our Enterprise Information Security Policy ("EISP").

companyName: Brookfield Asset Management Ltd.

ticker: BAM


text: The Audit Committee of our Board is responsible for overseeing risk management strategies that are specific to our company, including reviewing management's assessment of the current and emerging risks and related mitigation strategies across financial and non-financial risks, including cybersecurity risks. Regular reports and updates on cybersecurity risks are made to senior management of BAM. Pursuant to the EISP, executive management has appointed a Chief Information Security Officer ("CISO"), who works closely with senior management, legal counsel and external counsel to develop and monitor our data protection, privacy and cybersecurity program and policies. The CISO provides periodic reports to the Audit Committee, which subsequently reports to the Board about data protection and cybersecurity risks and issues. The CISO has over 20 years' experience in cybersecurity oversight, holds a Bachelor's Degree in Computer Science and Economics from York University and holds a number of information security certifications, including: CISSP, CISM, CISA and CRISC.


text: We have a cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats. This includes compliance with the EISP. Our cybersecurity program performance and effectiveness are also frequently assessed and audited internally and by third parties.


text: We believe our cybersecurity program is reasonably designed to materially protect the integrity and availability of our information and technology. This program addresses security governance, security awareness, employee training, relevant access and end-point security, vulnerability management, penetration testing, security monitoring and incident response. We use technologies to optimize our security risk detection and response capabilities, in addition to access controls and anti-malware protections. We believe our practices align with the NIST Cybersecurity Framework in meeting and exceeding the industry average in cybersecurity practice.


text: In addition, all employees regularly undergo mandatory continuing cybersecurity training. Employees in higher-risk functions receive additional training and cybersecurity awareness education. Audits, cybersecurity simulations and employee testing results indicate that our program is effective in protecting our information. The effectiveness of these programs is evaluated regularly through both internal and third-party audits.


text: In 2024, we undertook the following initiatives: further enhanced our data protection and threat-intelligence capabilities; improved our processes for third-party risk management; continued mandatory cybersecurity education for all employees; and incorporated social engineering to our phishing simulations. When we engage third parties, we have policies and processes to govern their access and reduce the risks associated with their access. For example, all third-party access must be authorized and have a legitimate business need. Prior to authorization and granting access, the terms and conditions of such access must be agreed to as part of a formal agreement or contract. In addition, all authorized third-party access must be limited, monitored and controlled as appropriate.


text: Our systems face cybersecurity risks, and we have in the past experienced threats to our data and systems. However, to date, these incidents have not had a material impact on our business strategy, results of operations, or financial condition. We can provide no assurance that we will not experience any material cybersecurity threats or incidents in the future. See "Part I—Item 1A. Risk Factors—Failure to maintain the security of our information and technology systems could have a material adverse effect on us".


text: We are externally managed by the Advisor, a subsidiary of Cohen & Steers, and representatives of the Company and the Advisor operate the Company's business through Cohen & Steers' information systems. Our business is dependent on the effectiveness of our and Cohen & Steers' information and cybersecurity policies and procedures to protect our and Cohen & Steers' network and telecommunications systems and the data that reside in or are transmitted through such systems.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Cybersecurity is a crucial component of our risk management processes and of Cohen & Steers' enterprise risk management program. Like many companies, we, Cohen & Steers and our and our external providers have been subject to, and expect to continue to be subject to, a range of cybersecurity threats and risks. Cohen & Steers has invested significant resources into cybersecurity and risk management processes to adjust to the continuing evolution in cybersecurity and respond to related threats.


text: Cohen & Steers has implemented and maintained various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software and critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to Advisor clients and investments ("Information Systems and Data").


text: Cohen & Steers' cybersecurity risk management function is led by its Chief Information Security Officer ("CISO") and Chief Technology Officer ("CTO") and includes members of its Information Technology ("IT") department and other personnel that oversee its information security and engineering operations. Input and guidance are also provided by members of its Legal and Compliance departments. Together, these employees (collectively referred to as members of the "Cybersecurity Management") are primarily responsible for developing, implementing and monitoring Cohen & Steers' cybersecurity program and reporting on cybersecurity matters to Cohen & Steers' senior management as well as our Audit Committee, on behalf of our Board.


text: Members of Cybersecurity Management identify and assess risks from cybersecurity threats by monitoring and evaluating Cohen & Steers' threat environment and enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from various professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting scans of Cohen & Steers' threat environment; (iv) evaluating Cohen & Steers' and its industry's risk profile; (v) evaluating threats that are reported to or discovered by Cohen & Steers; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of the information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.


text: Cohen & Steers has implemented and maintained various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to Information Systems and Data, including, but not limited to: • technical and physical safeguards: (i) systems monitoring, including anti-virus/anti-malware software for workstations and servers, reports about correlated events detected from server log reviews, desktop forensics software and suspicious firewall traffic, firewall logs and alerts from users about blocked websites, systems monitoring of Cohen & Steers' websites, network monitoring software alerts and scheduled internal and external vulnerability scans; (ii) Cohen & Steers' asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Cohen & Steers' personnel and from third parties regarding issues and signs of potential incidents; and (vi) access controls and network security controls; and • organizational safeguards: (i) incident response plans that address Cohen & Steers' response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing Cohen & Steers' cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of Cohen & Steers' policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, such as audits, tabletop exercises, threat modeling and vulnerability testing; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.


text: Cybersecurity risk management processes are integrated into the Board's ongoing evaluation and management of risks that are essential to our success, including as it relates to its oversight of the Advisor. At least annually, our Audit Committee reviews the cybersecurity program of the Advisor. Further, cybersecurity risk management is integrated into the Cohen & Steers' overall enterprise risk management process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by Cohen & Steers' information technology security team; (ii) internal and external penetration tests are performed to identify any vulnerabilities and findings are risk ranked based on potential likelihood and impact and (iii) the CTO reports on cybersecurity risk management and related matters annually to the Audit Committee, as part of its ongoing evaluation and oversight of the Advisor's cybersecurity program.


text: Third-party service providers play a key role in Cohen & Steers' cybersecurity program. Cohen & Steers uses third-party service providers to assist in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and monitoring Cohen & Steers' environment 24 hours a day and seven days a week. Cohen & Steers has currently engaged with professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring firms and cyber insurance brokers and providers. Members of the Advisor's management report key findings of such assessments to our Audit Committee and Cohen & Steers adjusts its cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.


text: Cohen & Steers also uses third-party service providers to perform a variety of functions throughout its business, such as application providers, hosting companies and supply chain resources. Cohen & Steers maintains a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by its engagement of third parties, including key vendors, service providers and other external users of its information systems, as well as the information systems of third parties that could adversely impact its business in the event of a cybersecurity incident affecting those third-party systems. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue and the identity of the provider, Cohen & Steers' vendor risk management program may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider. Cohen & Steers' vendor risk management program may entail: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and Cohen & Steers' review of the vendor's written security program, security assessments and other reports; (v) provision from the vendor of a System and Organization Controls ("SOC") 1 or SOC 2 report to evidence cybersecurity preparedness; and (vi) the imposition of contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we or Cohen & Steers fail to implement effective information security policies and procedures."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of Cohen & Steers' Cybersecurity Management, including its CISO, CTO and Head of IT Infrastructure.


text: • Cohen & Steers' CISO oversees the information security group and program within its IT department and holds a Bachelor of Arts degree in computer science. The CISO has served in various roles in information technology for over 24 years within the financial services industry, including previously serving as Head of Information Security and Enterprise Infrastructure, Head of IT Audit and Chief Information Security Officer at other companies, and holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Cohen & Steers' CTO oversees the IT department and holds a PhD in computer science, an MBA and Postgraduate Diploma in physics. The CTO has served in various roles in information technology for over 28 years, including senior leadership roles for the investment banking division of a financial services company. • Cohen & Steers' Head of IT Infrastructure oversees the infrastructure and service desk departments within the IT department and holds a Bachelor of Business Administration degree in finance and computer information systems. The Head of IT Infrastructure has served in various roles in information technology for over 20 years.


text: Members of Cohen & Steers' Cybersecurity Management, including the CISO and the CTO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into Cohen & Steers' overall risk management strategy and communicating key priorities to relevant personnel. Members of Cybersecurity Management, including the CISO and CTO, are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Cohen & Steers' cybersecurity incident response plan is a key component of its cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with the Cohen & Steers' incident response team to help Cohen & Steers control, mitigate and remediate cybersecurity incidents of which they are notified. In addition, the response plan includes prompt reporting to our Board (or the Audit Committee) of certain cybersecurity incidents and of the materiality and disclosure determinations relating thereto.