text: Our Board has delegated the primary responsibility for oversight and review of the Company's cybersecurity program to the Audit Committee. The Audit Committee actively participates in discussions regarding cybersecurity risk exposures and steps taken by management of Cohen & Steers to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to Cohen & Steers and align Cohen & Steers' risk exposure with our strategic and business objectives. At least annually, the Audit Committee reviews with the Advisor and Cohen & Steers' CTO the Cohen & Steers' cybersecurity program, including the robustness and efficacy of Cohen & Steers' overall cybersecurity program, steps taken to enhance defenses and security measures in place and its established plans to identify, detect and respond to threats Cohen & Steers may encounter. The Audit Committee also annually reviews and discusses with the Advisor cyber insurance coverage. In addition, as necessary, our Board (or the Audit Committee) receives reports and communications from the Advisor regarding material risks and specific developments that may cover topics such as: the Advisor's computerized information system controls; the impact of new cybersecurity-related rules and regulations; changes in the threat environment including new and emergent risks; and evolving information security standards and market practices including with respect to peers and third parties.


text: We are externally managed by the Advisor, a subsidiary of Cohen & Steers. Representatives of the Company and the Advisor operate the Company's business through Cohen & Steers' information systems. Our business depends on the effectiveness of our and Cohen & Steers' information and cybersecurity policies and procedures to protect our and Cohen & Steers' network and telecommunications systems and the data that reside in or are transmitted through such systems.

companyName: Cohen & Steers Income Opportunities REIT, Inc.

secItem: Item 1C


text: Cybersecurity is a crucial component of our risk management program and of Cohen & Steers' enterprise risk management program. Cohen & Steers has implemented and maintains various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software and critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to Advisor clients and investments.


text: Cohen & Steers' cybersecurity risk management function is led by its Cybersecurity Management team which is composed of its Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO"), members of its Information Technology ("IT") department as well as members of its Legal and Compliance departments. Its Cybersecurity Management team is primarily responsible for developing, implementing and monitoring its cybersecurity program and reporting on cybersecurity matters to Cohen & Steers' senior management as well as our audit committee, on behalf of our Board.


text: Members of Cohen & Steers' Cybersecurity Management team identify and assess risks from cybersecurity threats by monitoring its threat environment and enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting periodic vulnerability scans of Cohen & Steers' IT environment; (iv) evaluating Cohen & Steers' and its industry's risk profile; (v) evaluating threats that are reported to Cohen & Steers; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of Cohen & Steers' information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.


text: Cohen & Steers has implemented and maintains various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including: • technical and physical safeguards: (i) real-time security information and event monitoring of systems, workstations, servers and networks, and periodic internal and external vulnerability scans; (ii) asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Cohen & Steers' personnel and from third parties regarding issues and signs of potential incidents; and (vi) logical access controls and network security controls; and • organizational safeguards: (i) incident response plans that address Cohen & Steers' response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing Cohen & Steers' cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of Cohen & Steers' policies, standards, processes and practices designed to address cybersecurity threats and incidents; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.


text: Cybersecurity risk management is integrated into Cohen & Steers' overall enterprise risk management process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by Cohen & Steers' IT security team; (ii) internal and external penetration tests are performed to identify vulnerabilities and findings are risk ranked based on potential likelihood and impact; and (iii) members of Cohen & Steers' Cybersecurity Management report on cybersecurity risk management and related matters to our audit committee, as part of their ongoing evaluation and oversight of such risk pursuant to non-exclusive authority delegated by the Board.


text: Cohen & Steers uses third-party service providers to assist in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and continuous monitoring of Cohen & Steers' environment. Members of the Advisor's management report key findings to our audit committee and Cohen & Steers adjusts its cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.


text: Cohen & Steers also uses third-party service providers to perform a variety of functions throughout its business, such as application providers, hosting companies and supply chain resources. Cohen & Steers maintains a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by its engagement of third parties, as well as the information systems of third parties that could adversely impact its business in the event of a cybersecurity incident affecting those third-party systems. Cohen & Steers' vendor risk management program may involve different assessments designed to help identify cybersecurity risks including: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and its review of the vendor's written security program, security assessments and other reports; (vi) evidence of cybersecurity preparedness through a System and Organization Controls ("SOC") 1 or SOC 2 report; and (vii) the imposition of contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we or Cohen & Steers fail to implement effective information security policies and procedures."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of Cohen & Steers' Cybersecurity Management, including its CISO, CTO and Head of IT Infrastructure.


text: • Cohen & Steers' CISO oversees the information security group and program within its IT department, has over 25 years of experience, including similar roles at other financial services companies, holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Cohen & Steers' CTO oversees its IT department and has served in various roles in information technology for over 29 years, including senior leadership roles at another financial services company. • Cohen & Steers' Head of IT Infrastructure oversees the infrastructure and service desk within its IT department and has served in various roles in information technology for over 13 years.


text: Members of Cohen & Steers' Cybersecurity Management, including its CISO and its CTO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Cohen & Steers' overall risk management strategy and communicating key priorities to relevant personnel. Members of Cohen & Steers' Cybersecurity Management, including its CISO and its CTO, are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Cohen & Steers' cybersecurity incident response plan is a key component of its cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with Cohen & Steers' incident response team to help control, mitigate and remediate cybersecurity incidents. In addition, the response plan includes prompt reporting to our Board (or the audit committee) of certain cybersecurity incidents and related materiality and disclosure determinations.


text: Our Board has delegated the primary responsibility for oversight and review of the Company's cybersecurity program to the audit committee. The audit committee actively participates in discussions regarding cybersecurity risk exposures and steps taken by management of Cohen & Steers to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to our Company and align our risk exposure with our strategic and business objectives. At least annually, the audit committee reviews with the Advisor and Cohen & Steers' CISO and its CTO Cohen & Steers' cybersecurity program, including the robustness and efficacy of Cohen & Steers' overall cybersecurity program, steps taken to enhance defenses and security measures in place and its established plans to identify, detect and respond to threats Cohen & Steers may encounter. The audit committee also annually reviews and discusses with the Advisor cyber insurance coverage. In addition, as necessary, our Board (or the audit committee) receives reports and communications from the Advisor regarding material risks and specific developments that may cover topics such as: the Advisor's computerized information system controls; the impact of new cybersecurity-related rules and regulations; changes in the threat environment including new and emergent risks; and evolving information security standards and market practices, including with respect to peers and third parties. As of December 31, 2024, neither we nor Cohen & Steers had experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: We recognize the importance of being able to assess, effectively respond to, and manage material cybersecurity threats and incidents that may compromise the confidentiality, integrity or availability of our information systems, data, or network resources. To address these concerns, we plan to develop and implement company-wide policies and procedures to help raise awareness of, identify, assess, and manage cybersecurity threats. Our Information Security organization will have primary responsibility for the implementation of our cybersecurity policies and procedures and the management of our responses to information technology and security risks, including risks related to cybersecurity threats.

companyName: Revelyst, Inc.


text: Risk identification will be managed through Information Technology ("IT") programs and service providers that specialize in identifying such risks, employee training, and information security policies. The cybersecurity team will conduct internal and external penetration testing with outside third-party cybersecurity experts. Employee training programs will be used to reinforce our information security policies, standards and practices, as well as the expectation that employees comply with these policies and to train employees on how to identify potential cybersecurity risks and protect our resources and information.


text: Our Information Security organization will be responsible for identifying the key responders for each security incident and maintaining engagement and communication throughout the incident lifecycle, which may include, among other things, containment, eradication, recovery, and a review of lessons learned. When necessary, the Information Security team will involve members of management and other representatives of our IT, Finance, Legal, and Internal Audit teams, with assistance of third-party consultants and outside legal counsel as appropriate, to assist in assessing the potential materiality of a cybersecurity incident. When necessary, these matters will be brought to the attention of the Audit Committee of the Board.


text: To manage cybersecurity risks related to third-party service providers, we plan to conduct security assessments of certain third-party providers before engagement and will establish monitoring procedures related to data breaches or other security incidents originating from third parties. To assist in this effort, we may from time to time engage third-party consultants, legal advisors, and audit firms to evaluate and test our risk management systems and assess and remediate certain potential cybersecurity incidents as appropriate.


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the Company or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and there can be no assurance that our cybersecurity risk management policies and procedures will be fully implemented, complied with or successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our business strategy, results of operations, or financial condition, please refer to "Item 1A Risk Factors- Risks Related to the Revelyst Business- If Revelyst's efforts to protect the security of personal information about Revelyst's customers and consumers are unsuccessful and unauthorized access to that personal information is obtained, or Revelyst experiences a significant disruption in Revelyst's computer systems or a cybersecurity breach, such as the ransomware attack experienced by Fox Racing in April 2021 prior to being acquired by Revelyst, Revelyst could experience an adverse effect on its operations, Revelyst could be subject to costly government enforcement action and private litigation and Revelyst's reputation could suffer."


text: The Revelyst Board is expected to receive an annual report on the enterprise risk management review overseen by the Revelyst Audit Committee, which will include, among other things, an evaluation of cybersecurity risks (including cybersecurity risks that Revelyst may have exposure to via its suppliers and service providers), mitigation efforts, incident response preparedness and adequacy of internal controls. In addition, the Revelyst Board is expected to receive in-depth updates from Revelyst's information technology team on cybersecurity risks on a regular basis.


text: Management's Role in Managing Risk and Monitoring Incidents The leaders of our Information Security organization will be responsible for assessing and managing our material risks from cybersecurity threats and supervision of both our internal information security personnel and our retained external cybersecurity consultants.


text: Other members of our management team, including those from legal, finance, and internal audit, will supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants we engage; and alerts and reports produced by security tools deployed in the IT environment.


text: The management team anticipated to have primary responsibility for assessing and managing Revelyst's cybersecurity risks have extensive years of collective experience on the subject and members hold multiple certifications, including CISSP, CCNP, CISA, and CySA+.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive data and applications of our customers ("Information Systems and Data"). Rubrik, Inc.

companyName: Rubrik, Inc.

ticker: RBRK


text: Our Chief Information Security Officer ("CISO") and the direct reports to the CISO (including the Senior Director of Information Security and the Senior Director for Governance, Risk and Compliance, collectively, the "CISO Team") help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of a risk register. The CISO Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and/or external audits, conducting vulnerability assessments to identify vulnerabilities, use of external intelligence feeds, and third-party-conducted red/blue team testing and tabletop incident response exercises.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan and/or incident response policy, incident detection and response, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards/certifications, encryption of data, network security controls, access controls, physical security, vendor risk management program, employee training, penetration testing, cybersecurity insurance, dedicated cybersecurity staff/officer, and systems monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is identified in and a component of the Company's risk register; (2) the CISO Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and (3) our information security team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services, and forensic investigators.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessment for each vendor, security questionnaires, review of the vendor's written security program, review of security assessments and reports, audits, calls with vendors security personnel, and contractual obligations regarding cybersecurity imposed on each vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CISO Team, along with other members of management.


text: Our CISO Team is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CISO Team is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our crisis management team. The CISO Team works with our crisis management team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports from the CISO team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. Rubrik, Inc.


text: Our process for assessing, identifying and managing material risks from cybersecurity threats is integrated into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity organization continually evaluates and addresses cybersecurity risk in alignment with our business objectives. We employ automation, and we also engage our internal audit function and a range of external consultants and other expert third parties in connection with the evaluation and management of cybersecurity risk and the maturation of our cybersecurity program.

companyName: Kenvue Inc.

ticker: KVUE


text: Our cybersecurity organization assesses and manages cybersecurity risk through technical, physical and administrative controls, including implementing cybersecurity policies, procedures and strategies, with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while increasing our system resilience in an effort to minimize business impact should an incident occur. The underlying controls of the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, we maintain a Data Incident Response Program, which is designed to identify, assess, manage and report significant data incidents, including those reasonably likely to affect our business strategy, results of operations or financial condition. The Data Incident Response Program outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas, senior management, and the Company's disclosure committee or a sub-committee thereof as appropriate. The disclosure committee or a sub-committee thereof will consider the materiality of an incident elevated by the Data Incident Response Program, inform the Board and other key stakeholders as appropriate, and determine the Company's reporting obligation on a timely basis.


text: We rely heavily on our supply chain to deliver our products to our customers and consumers, and a cybersecurity incident at a supplier or partner could materially adversely impact us. As such, we have processes in place to oversee and identify risks from cybersecurity threats associated with suppliers and our use of third-party service providers, including through our Supplier Cyber Risk Assessment process, which assesses third-party cybersecurity controls through a combination of risk assessment questionnaires, commercially available risk data and proprietary algorithms. We also include security and privacy addendums to our contracts where applicable. We require that our suppliers and partners report cybersecurity incidents to us so that we can assess the impact of such an incident on us and have dedicated processes to respond to cybersecurity incidents at third parties.


text: Risks from cybersecurity threats did not materially affect our results of operations or financial condition during the period covered by this filing.


text: Cybersecurity related risks are one of the key risks contemplated by our Enterprise Risk Management ("ERM") Framework. The ERM Framework informs our strategic planning activities through a collaborative risk management environment that proactively identifies and prioritizes our strategic, preventable, and external risks (including new or changing regulations). The ERM Framework enables a clear understanding of the top risks and the exposure they have to our performance and strategic decisions. The ERM Framework is reviewed annually as part of a risk assessment that is presented to our Board.


text: Our ERM Framework describes the roles and responsibilities of the Integrated Risk Management Council, a cross-functional group of senior enterprise risk leaders, which meets regularly to review and discuss significant risk facing our business, including cybersecurity risk. Our Integrated Risk Management Council, which includes our Chief Information Security Officer ("CISO") proactively identifies, assesses and prioritizes key or emerging risks, which are then escalated to senior management as needed and, in the case of cybersecurity risk, reported to the Nominating Governance & Sustainability Committee or our full Board.


text: The Nominating, Governance and Sustainability Committee of our Board (the "NG&S Committee") is responsible for assisting the Board with respect to designated risk oversight matters, including privacy and cybersecurity. The NG&S Committee receives reports from, and meets at least twice a year and as needed with, the CISO and the Chief Privacy Officer. The CISO and the Chief Privacy Officer inform the NG&S Committee, which in turn informs our Board, of risks from cybersecurity threats during such meetings. The NG&S Committee reports to our full Board following each of its regularly scheduled meetings at a minimum and reviews with our Board significant issues or concerns that arise at NG&S Committee meetings.


text: Our cybersecurity organization is led by our CISO. Our CISO leads a global team to develop our strategic cybersecurity priorities and execute operational plans. He has over 25 years of cybersecurity experience in the healthcare, finance and telecommunications industries and in government. Prior to his role at Kenvue, our CISO spent over ten years at J&J in cybersecurity, and he retired from the United States Air Force Reserves in 2018 as a Lieutenant Colonel, where he had responsibility for cybersecurity. He is a Certified Information Systems Security Professional and holds a Masters in Telecommunications Management from the University of Maryland, University College. The members of the cybersecurity organization have decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and rely on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants.


text: Notwithstanding our cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For a discussion of cybersecurity risks, see Item 1A, "Risk Factors —Risks Related to Our Operations—An information security incident, including a cybersecurity breach, or the failure, interruption, breakdown, invasion, corruption, destruction, or breach of an information technology system owned or operated by us or a third party, could adversely affect our business, results of operations or financial condition."


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity organization continually evaluates and addresses cybersecurity risk in alignment with our business objectives to address the evolving regulatory landscape and emerging risks, including those resulting from geopolitical shifts and technological innovations such as the growth of cloud technologies and artificial intelligence. We maintain a formal cybersecurity training program, including annual trainings for all Kenvuers, covering, among other topics, phishing, email security, and data privacy. We employ automation, and we also engage our internal audit function and a range of external consultants and other expert third parties in connection with the evaluation and management of cybersecurity risk and the maturation of our cybersecurity program.


text: Our cybersecurity organization assesses, monitors, and manages cybersecurity risk through technical, physical, and administrative controls, including implementing cybersecurity policies, procedures, and strategies, with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while increasing our system resilience in an effort to minimize business impact should an incident occur. The underlying controls of the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, we maintain a Data Incident Response Program, which is designed to identify, assess, manage, and report significant data incidents, including those reasonably likely to affect our business strategy, results of operations, or financial condition. In the event of a cybersecurity incident, our cybersecurity team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm, with support from external technical and legal advisors and law enforcement, as appropriate. The Data Incident Response Program outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas, senior management, and the Company's Disclosure Committee or a sub-committee thereof as appropriate. The Disclosure Committee or a sub-committee thereof will consider the materiality of an incident elevated by the Data Incident Response Program, inform our Board and other key stakeholders as appropriate, and determine the Company's reporting obligation on a timely basis. Our organization tests and monitors these processes, including through table-top exercise testing with senior leaders.


text: We rely heavily on our supply chain to deliver our products to our customers and consumers, and a cybersecurity incident at a supplier or partner could materially adversely impact us. As such, we have processes in place to oversee and identify risks from cybersecurity threats associated with suppliers and our use of third-party service providers, including through our Supplier Cyber Risk Assessment process, which assesses third-party cybersecurity controls through a combination of risk assessment questionnaires, commercially available risk data, and proprietary algorithms. We also include security and privacy addendums to our contracts where applicable. We require that our suppliers and partners report cybersecurity incidents to us so that we can assess the impact of such an incident on us and have dedicated processes to respond to cybersecurity incidents at third parties.


text: Risks from cybersecurity threats did not materially affect our results of operations or financial condition during the fiscal twelve months ended December 29, 2024.


text: Cybersecurity-related risks are one of the key risks contemplated by our Enterprise Risk Management ("ERM") Framework. The ERM Framework informs our strategic planning activities through a collaborative risk management environment that proactively identifies and prioritizes our strategic, preventable, and external risks (including new or changing regulations). The ERM Framework enables a clear understanding of the top risks and the exposure they have to our performance and strategic decisions. The ERM Framework is reviewed annually as part of a risk assessment that is presented to our Board.


text: Our ERM Framework describes the roles and responsibilities of the Integrated Risk Management Council, a cross-functional group of senior enterprise risk leaders, which meets regularly to review and discuss significant risk facing our business, including cybersecurity risk. Our Integrated Risk Management Council, which includes our Chief Information Security Officer ("CISO"), proactively identifies, assesses, and prioritizes key or emerging risks, which are then escalated to senior management as needed and, in the case of cybersecurity risk, reported to our Board's Nominating, Governance & Sustainability Committee (the "NG&S Committee") or our full Board.


text: The NG&S Committee is responsible for assisting our Board with respect to designated risk oversight matters, including privacy and cybersecurity. The NG&S Committee receives reports from, and meets at least twice a year and as needed with, the CISO and the Chief Privacy and Digital Officer ("CPDO"). The CISO and the CPDO inform the NG&S Committee, which in turn informs our Board, of risks from cybersecurity threats during such meetings. The NG&S Committee reports to our full Board following each of its regularly scheduled meetings at a minimum and reviews with our Board significant issues or concerns that arise at NG&S Committee meetings. In addition, in February 2025, the CISO and the CPDO reviewed with our Board the cybersecurity and privacy programs, the Data Incident Response Program, and the role of our Board related thereto.


text: Our CISO leads a global cybersecurity organization, which develops our strategic cybersecurity priorities and executes operational plans. Our CISO has over 25 years of cybersecurity experience in the healthcare, finance, and telecommunications industries and in government. Prior to his role at Kenvue, our CISO spent over 10 years at J&J in cybersecurity, and he retired from the United States Air Force Reserves in 2018 as a Lieutenant Colonel, where he had responsibility for cybersecurity. He is a Certified Information Systems Security Professional and holds a Masters in Telecommunications Management from the University of Maryland, University College and a Directorship Certification from the National Association of Corporate Directors. Our CPDO has over 10 years of privacy and digital legal experience. Prior to his role at Kenvue, our CPDO worked for over 15 years in J&J's Law Department. He also worked as a lawyer in private practice at the law firm Linklaters LLP, in industry associations, and in government, and he acted as Vice Chair of the Consumer Goods Privacy+ Consortium, an association developing compliance strategies and best practices to meet requirements of global privacy laws. He holds a Juris Doctor from Luiss Guido Carli University (Rome, Italy) and a Master of Laws in European Law and Economic Analysis from the College of Europe (Bruges, Belgium). The other members of the cybersecurity organization have decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants.


text: Notwithstanding our cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For a discussion of cybersecurity risks, see Part I, Item 1A, "Risk Factors—Risks Related to Our Operations—An information security incident, including a cybersecurity breach, or the failure of an information technology or operational technology system owned or operated by us or a third party, could adversely affect us."


text: Our operations are highly dependent on the information systems and technology of Blue Owl, the indirect affiliate of our Adviser, which has implemented a cybersecurity management program. Below are details Blue Owl has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blue Owl Real Estate Net Lease Trust


text: Processes and Risk Assessment Blue Owl's cybersecurity program is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Blue Owl's Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and their team are responsible for implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and helping identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: Our Board of Trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as our full Board of Trustees, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Cybersecurity risks and cyber incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Increased data protection regulation may result in increased complexities and risks in connection with the operation of our business and products."


text: Processes and Risk Assessment Blue Owl's cybersecurity program is focused on (i) protecting confidential business, client, investor and employee information that they store or process; (ii) maintaining the security and availability of systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Blue Owl's Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and their team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and helping identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by Blue Owl IT Management. When Blue Owl engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Blue Owl has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage, and report cybersecurity events, which is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, their Audit Committee or their Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with senior members of Blue Owl's management, their Audit Committee or their Board of Directors, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by Blue Owl's IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing the monitoring and alert response processes, vulnerability management, changes made to critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: Our Board of Trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as our full Board of Trustees, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Increased data protection regulation may result in increased complexities and risks in connection with the operation of our business and products."


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information and operational technologies and protect the confidentiality, integrity, and availability of our data. Our business is dependent upon our computer systems, devices, software and networks (operational and information technology) to collect, process and store the data necessary to conduct almost all aspects of our business, including the evaluation of acquisition and development opportunities, the monitoring and evaluation of our existing properties and the performance of and data from our operators and the recording and reporting of financial information.

companyName: Vitesse Energy, Inc.

ticker: VTS


text: Assessing, Identifying and Managing Material Cybersecurity Risks & Integrated Overall Risk Management. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees mechanisms to detect and monitor unusual network activity and containment and incident response tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We monitor issues that are internally discovered or externally reported that may affect our systems, and have processes to assess those issues for potential cybersecurity impact or risk.


text: The Company has integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to include cybersecurity considerations as part of our decision-making processes at every level. Our IT department seeks to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs and coordinates with our overall risk management framework.


text: In the event of a cybersecurity incident, we maintain an incident response plan. This plan sets forth immediate actions to mitigate the impact of cybersecurity incidents, including referring certain matters to the Company's Chief Executive Officer ("CEO") for additional evaluation and oversight, as well as long-term strategies for remediation and prevention of future cybersecurity incidents.


text: Engaging Third Parties on Cybersecurity Risk Management. Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of third-party service providers, including cybersecurity assessors, and consultants, in evaluating and testing our cybersecurity risk management systems. This enables us to leverage knowledge and insights with the goal of aligning our cybersecurity strategies and processes with best practices for our industry and size. Accordingly, we engage third-party service providers for regular cybersecurity-related audits, threat assessments, and consultation on security enhancements.


text: Overseeing Third-Party Risk. Because we are aware of the risks associated with engaging third-party service providers, the Company has implemented processes designed to oversee and manage these risks. It is our policy to conduct security assessments of all third-party service providers before engagement and we aim to maintain ongoing monitoring for compliance with our cybersecurity standards. This monitoring includes regular assessments by our Director of Infrastructure and Cybersecurity.


text: As of the date of this Annual Report on Form 10-K, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our operations or financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. Risk Factors "Risk Factors Relating to Our Business—We depend on computer and telecommunications systems, and failures in our systems or cyber security threats, attacks or other disruptions could significantly disrupt our business operations." for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: The Board has overall responsibility for the oversight of risk management at Vitesse, which includes cybersecurity risks. The Board receives periodic briefings on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities from members of management, who are responsible for overseeing our cybersecurity program. In addition, the Board receives annual briefings from our Director of Infrastructure and Cybersecurity,on our cybersecurity program. Our internal auditor also reports to the Audit Committee on the internal controls and procedures that are implemented to assess and mitigate cybersecurity risk on an as needed basis.


text: Our cybersecurity risk assessment and management efforts are led by our Director of Infrastructure and Cybersecurity, who is responsible for implementing and overseeing processes for the monitoring of our information systems. This includes responsibility for the deployment of cybersecurity measures and system audits to identify potential cybersecurity vulnerabilities. Our IT Department, including our Director of Infrastructure and Cybersecurity, reports directly to our CEO. Our Director of Infrastructure and Cybersecurity has significant experience in the field of information technology and is an ISACA Certified Information Security Manager (CISM).


text: The Board has overall responsibility for the oversight of risk management at Vitesse, which includes cybersecurity risks. The Board receives periodic briefings on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities from members of management, who are responsible for overseeing our cybersecurity program. In addition, the Board receives annual briefings from our Director of Infrastructure and Cybersecurity, on our cybersecurity program. Our internal auditor also reports to the Audit Committee on the internal controls and procedures that are implemented to assess and mitigate cybersecurity risk on an as needed basis.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the our day-to-day operations and has implemented a cybersecurity program that applies to us and our operations.

companyName: Willow Tree Capital Corp


text: Governance and Oversight of Cybersecurity Risk The Adviser has instituted a cybersecurity program, overseen by the Adviser's Chief Compliance Officer ("CCO"), which is designed to assess, identify, and manage material cyber risks applicable to us. The cyber risk management program involves risk assessments, identification of sensitive information assets ("Critical Information"), implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely on. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: We rely on the Adviser to engage external experts, including cybersecurity consultants, to evaluate cybersecurity measures and risk management processes, and depends on and engages various third parties, including suppliers, vendors, and service providers. The Adviser conducts ongoing due diligence of its significant service providers to determine whether the cybersecurity programs of service providers include, among other things, procedures and safeguards designed to ensure the protection of Critical Information.


text: Our Board would be made aware of any material risks associated with cybersecurity threats. Our Board currently receives periodic updates from our CCO regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Our management team, including our CCO, is responsible for assessing and managing material risks from cybersecurity threats. Our CCO, in managing such risks relating to cybersecurity threats, relies on the assistance provided by the Adviser.


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of material cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with legal, information technology, and/or compliance personnel of the Adviser.


text: Impact of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, results of operations, and financial condition are regularly evaluated. During the reporting period, we have not identified any material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operation, and financial condition.


text: As an externally managed company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. We rely on IT systems, data hosting and other hardware and software platforms which are hosted by EQT, the parent company of our Advisor. As such, we are reliant on EQT for assessing, identifying and managing cybersecurity risk as part of its overall Risk Management Framework.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: Cybersecurity risk is an important and continuously evolving focus for us, EQT, and EQT's affiliates. EQT maintains a cybersecurity program as part of its Risk Management Framework, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by EQRT, from anticipated threats or hazards. EQT utilizes a variety of protective measures as a part of its and our cybersecurity program. These measures include: • IT General Controls: including physical and digital access controls, patch management, identity verification and mobile device management. • Risk Identification: EQT utilizes a combination of internal processes and third-party services to identify potential information security vulnerabilities and threats. This includes threat intelligence, vulnerability management and various security assessments. • Risk Assessment: Identified risks are assessed and ranked on at least an annual basis using a likelihood and impact assessment as part of EQT's enterprise risk framework. In addition, the security team has in place an information security risk management process through which risks are assessed, managed and reported upon continuously. • Risk Management: Risks are managed based on their severity in relation to the established risk appetite. EQT has in place several risk-mitigating controls, blending preventative, detective, and reactive measures with an emphasis on identity verification, least privilege, micro-segmentation, and a strong security culture. To this foundation, EQT adds critical components like data protection endpoint security, secure configurations, advanced monitoring and threat detection, robust incident and business continuity plans for effective response. EQT continuously modifies its controls in line with our current risk landscape. • Incident Management: EQT has implemented a security incident response plan for prompt and effective handling of cyber incidents. This plan is executed by a tiered response team: a 24/7 Security Operations Center serves as the first line of defense, followed by EQT's internal security team as the second tier, and an expert incident response and forensics firm as the third. Additional support from external legal counsel is available when necessary. The strategy ensures collaboration with key functions like Risk, Regulatory & Compliance, Corporate Legal and Communications. Detailed playbooks within the plan outline specific actions for various security incident types. At the corporate level, an incident reporting and management process involves EQT's Chief Information Security Officer ("CISO"). Should an incident pertain to cybersecurity, it activates the security incident response plan. • Ongoing Testing: EQT's comprehensive program encompasses a range of measures and enterprise-level drills. This includes conducting phishing test campaigns, mandatory annual training, annual penetration tests, and disaster recovery tests to ensure EQT's systems resilience. At the enterprise level, EQT also holds an annual tabletop exercise for EQT's core and extended crisis management teams, simulating various hypothetical scenarios to assess our preparedness and response strategies.


text: EQT's technology systems and those of its, the Adviser's and our third-party service providers are vital for sustaining our operations and strategic initiatives. To manage the risks inherent in these vendor relationships effectively, EQT has established a series of processes. EQT and the Adviser engage only with third parties that align with our stringent cybersecurity standards, demanding that these providers demonstrate strong capabilities in key areas such as data protection, incident preparedness, continuity, and vendor risk management. Adopting a risk-based strategy allows EQT to prioritize its efforts, focusing on the most critical vendors to ensure its attention is directed where it is most needed. In regards to EQT's most critical vendors, EQT requires substantial and credible third-party assurances, such as Service Organization Control Type 2 certifications ("SOC 2") and International Organization for Standardization ("ISO") certifications, ensuring they meet its high cybersecurity standards.


text: Further, the contracts for EQRT, the Adviser and EQT include stringent data protection and liability clauses in the event of a breach.


text: Governance and Oversight EQT's cybersecurity governance structure is led by the CISO, responsible for EQT's cybersecurity program. The CISO has 15 years of experience working with cybersecurity, business continuity, risk management and technology across several industries and holds a Master and a Bachelor of Computer Science and Engineering. The CISO heads the Security and Platform Engineering Team ('SPET') of dedicated information security professionals and site reliability engineers, concentrating on the security and stability of the technical platform. SPET collaborates closely with other technology teams, such as the EQT information technology operations team. The CISO reports to the Information Security Steering Committee (the 'Steering Committee'), comprised of select Executive Committee members of EQT. The Steering Committee receives quarterly updates from the CISO. Furthermore, the CISO also reports annually to EQT's Audit Committee and twice a year to a member of EQT's board appointed to oversee cybersecurity risk. In addition, the Group Risk Function reports to the Risk Committee at least three times per year.


text: At the EQRT level, oversight of cybersecurity is the responsibility of our Board of Directors, receiving at least annual updates on EQT's cybersecurity program and receiving prompt notice regarding any material cybersecurity incidents that are relevant to EQRT, as well as ongoing updates regarding such incidents. EQT's cybersecurity program and processes also provide incident escalation to our Chief Financial Officer for any security incidents that meet pre-established reporting thresholds. EQRT's Chief Financial Officer determines if any cybersecurity events have taken place at the EQRT level and assesses whether those events are material to EQRT based on quantitative and qualitative criteria determined by EQRT's management, supported by external advisors. When determining the materiality of a cybersecurity event, EQRT considers the actual and potential impact on the EQRT operations, strategy, performance, cash flows and financial condition. EQRT adheres to EQT's Incident Handling Playbook and employee awareness training requirements.


text: Both EQT and its Adviser remain committed to adopting the highest cybersecurity standards and practices, continuously enhancing their cybersecurity capabilities, and prioritizing the safeguarding of company and customer data from potential threats. In the last fiscal year, EQT and EQRT have not experienced any cybersecurity incidents, that have materially affected us or are reasonably likely to have materially affected our operations, strategy, performance, cash flows or financial health. See Part I, Item 1A, "Risk Factors—Risks Related to Our Organization Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results."


text: The Company is subject to various laws and rules issued by multiple government agencies concerning the safeguarding and maintaining the confidentiality of its security, customer, and business information. We are committed to protecting the confidentiality, integrity, and availability of our information systems and data.

companyName: Mag Magna Corp

ticker: MGNC


text: The Board of Directors maintains oversight of our cybersecurity risks. The Company receives regular updates from management regarding cybersecurity program, including risk assessments, incident response capabilities, and the effectiveness of controls. Management is responsible for assessing and managing our material cybersecurity risks, as well as for the development and implementation of our cybersecurity policies, procedures, and controls, and are responsible for reporting on the program's status and any material cybersecurity incidents to the Board of Directors.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: As an externally managed company, our day-to-day operations are managed by our Advisor and our executive officers (all of whom are executive officers of our Advisor) under the oversight of our Board. We rely on our Advisor for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details our Advisor has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Net Lease Office Properties

ticker: NLOP


text: Our Advisor's cybersecurity approach incorporates a layered portfolio of comprehensive employee training programs, multiple resources to manage and monitor the evolving threat landscape and knowledgeable teams responsible for preventing and detecting cybersecurity risks.


text: Net Lease Office Properties 2023 10-K – 19 As part of our Board's oversight of risk management, our Board of Trustees will review our cyber-risks and the actions being taken to mitigate such risks with our Advisor. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for the Advisor's employees. Board oversight of risk is also performed as needed between meetings through our Audit Committee and communications between our Advisor and our Board of Trustees. Our Board of Trustees will receive periodic education around cybersecurity risks and best practices.


text: Additionally, our Audit Committee, which consists solely of independent trustees, is responsible for overseeing cybersecurity risks and related initiatives. Our Audit Committee reviews our enterprise risk and cybersecurity risks. It also reviews the steps our Advisor has taken to protect against threats to our information systems and security and receives updates on cybersecurity on a quarterly basis.


text: Our Advisor's information technology team is led by its Chief Information Officer who has extensive experience working with information security systems. Our Advisor's information technology team consists of individuals with expertise in assessing, preventing and addressing cybersecurity risk and is responsible for executing our cybersecurity program as well as communicating regularly with our Advisor's senior management, our Advisor's cybersecurity governance committee, the Audit Committee and the Board. Our Advisor's cybersecurity governance committee, comprised of the Advisor's Chief Financial Officer, Chief Legal Officer, Chief Information Officer, Head of Internal Audit and senior members of its information technology team, are responsible for developing and maintaining our cybersecurity policies and standards, monitoring ongoing compliance and program updates, and ensuring our information security is aligned with our business objectives and strategies under the oversight of our Board.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our Advisor's cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents and (3) containing, eradicating, recovering from and reporting cybersecurity events.


text: Prevention and Preparation Our Advisor employs a variety of measures to prevent threats related to privacy, information technology security and cybersecurity, which include password protection, frequent mandatory password change events, multi-factor authentication, internal phishing testing, vulnerability scanning and penetration testing.


text: Our Advisor's information technology and internal audit teams utilize frameworks based on industry standards to identify and mitigate information security risks and oversee an active cybersecurity training program. For example, in January 2023, our Advisor's information technology team held a tabletop exercise with senior management of the Advisor to consider different cybersecurity scenarios. Our Advisor's information technology team also recently worked with various third-party consultants to update our incident response plan.


text: In addition, our Advisor's information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for the Advisor's employees to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed. Our Advisor's internal audit team evaluates and monitors our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.


text: Third-party vendors are vetted through our Advisor's service delivery program to ensure they have an established cybersecurity program. Our Advisor has also engaged a managed security provider to manage a supply chain defense subscription that will help obtain clear visibility into cybersecurity risks across third party vendors by proactively identifying, prioritizing, and driving remediation for cyber risks posed by critical business partners. Our Advisor's managed security provider's risk operations center will escalate certain alerts regarding third-party vendors directly to the appropriate business partners thus providing direct collaboration with third parties, saving time and improving risk reduction while safeguarding our relationships with such third parties.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our Advisor's managed cybersecurity provider, notifications from our Advisor's employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our Advisor's incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the incident response team is initially focused on containing the cybersecurity incident as quickly and efficiently as possible, consistent with the procedures in the incident response plan. Containment procedures may include shutting down systems; disconnecting systems from a network, disabling specific ports, protocols, services, functions, etc., disabling access to compromised systems; examining code in a controlled environment and making forensic backups of affected systems for possible legal action for third party forensic analysis.


text: Once a cybersecurity incident is contained, the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident. They may include returning affected systems to an operationally ready state, confirming that the affected systems are functioning normally and implementing, as necessary, additional monitoring to look for future related activity.


text: Our Advisor has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts, including outside legal counsel, vendors and external insurance brokers.


text: In the event of a cybersecurity incident, we intend to follow the steps outlined in our Advisor's incident response plan, including notifying our Audit Committee and Board, as appropriate.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams. For a discussion of these risks, see Item 1A. Risk Factors – The occurrence of cyber incidents, or a deficiency in our Advisor's cybersecurity, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results.


text: As part of our Board's oversight of risk management, our Board will review our cyber-risks and the actions being taken to mitigate such risks with our Advisor. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for the Advisor's employees. Board oversight of risk is also performed as needed between meetings through our Audit Committee and communications between our Advisor and our Board. Our Board will receive periodic education around cybersecurity risks and best practices.


text: Our Advisor's information technology team is led by its Chief Information Officer who reports to its Chief Financial Officer and has extensive experience working with information security systems. Our Advisor's information technology team consists of individuals with expertise in assessing, preventing and addressing cybersecurity risk and is responsible for executing our cybersecurity program as well as communicating regularly with our Advisor's senior management, our Advisor's cybersecurity governance committee, the Audit Committee and the Board. Our Advisor's cybersecurity governance committee, comprised of the Advisor's Chief Financial Officer, Chief Legal Officer, Chief Information Officer, Head of Internal Audit and senior members of its information technology team, are responsible for developing and maintaining our cybersecurity policies and standards, monitoring ongoing compliance and program updates, and ensuring our information security is aligned with our business objectives and strategies under the oversight of our Board.


text: Our Advisor's information technology and internal audit teams utilize frameworks consistent with well-recognized industry cybersecurity frameworks to identify and mitigate information security risks and oversee an active cybersecurity training program.


text: In addition, our Advisor's information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for the Advisor's employees and board of directors to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed. Our Advisor's internal audit team evaluates and monitors our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.


text: Third-party vendors are vetted through our Advisor's service delivery program to ensure they have an established cybersecurity program. Our Advisor has also engaged a managed security provider to manage a supply chain defense subscription that will help obtain visibility into cybersecurity risks across third party vendors by proactively identifying, prioritizing, and driving remediation for cyber risks posed by critical business partners. Our Advisor's managed security provider's risk operations center will escalate certain alerts regarding third-party vendors directly to the IT Department thus providing direct collaboration with third parties, saving time and improving risk reduction while safeguarding our relationships with such third parties.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our Advisor's managed cybersecurity provider, notifications from our Advisor's employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our Advisor's incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event and assessing the severity of the event.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the incident response team is responsible for containing the cybersecurity incident, consistent with the procedures in the incident response plan.


text: Once a cybersecurity incident is contained, the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident. They may include returning affected systems to an operationally ready state and confirming that the affected systems are functioning normally.


text: In the event of a cybersecurity incident, the incident response team is responsible for following the steps outlined in our Advisor's incident response plan, including notifying our Audit Committee and Board, as appropriate.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any instances of material cybersecurity incidents that impacted the Company in the last three years. However, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See Item 1A. Risk Factors – The occurrence of cyber incidents, or a deficiency in our Advisor's cybersecurity, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results.


text: As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers (all of whom are executive officers of our Manager) under the oversight of our board of trustees. We rely on our Manager for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details our Manager has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Star Holdings

ticker: STHO


text: Our Manager has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our Manager's cybersecurity risk management program includes a cybersecurity incident response plan.


text: Our Manager has designed and assesses its program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that our Manager meets any particular technical standards, specifications, or requirements, only that our Manager uses the NIST CSF 2.0 as a guide to help it identify, assess, and manage cybersecurity risks relevant to our business.


text: Our Manager's cybersecurity risk management program is integrated into its overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our Manager's cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; the use of external service providers to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: Our Manager has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee is responsible for reviewing our Manager's implementation of our cybersecurity risk management program and evaluating its adequacy.


text: The Committee receives periodic reports from our Manager on our cybersecurity risks. In addition, our Manager updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from our Manager on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Manager's Head of IT, internal technology staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Manager's team, including its Head of IT, Head of Risk Management and Chief Legal Officer, are responsible for assessing and managing our material risks from cybersecurity threats. Our Manager has primary responsibility for our overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and its retained external cybersecurity consultants.


text: Our Manager supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy Overall Risk Management. The Company has implemented a cyber risk management program to help ensure that the Company's electronic information and information systems are protected from various threats and are built on and follow the Cybersecurity Maturity Model Certification for information security requirements and the protection of sensitive information. The cyber risk management program is maintained as part of the Company's overall governance, enterprise risk management program and compliance program. The Company's information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach the Company's cyber-defenses. The Company may face increased cyber risk due to the increased use of employee-owned devices and work from home arrangements. The Company also has cyber event related insurance. The Company is continuously reevaluating the need to upgrade and/or replace systems and network infrastructure.

companyName: Knife River Corp

ticker: KNF


text: These upgrades and/or replacements could adversely impact operations by imposing substantial capital expenditures, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect the Company. The Company continually assesses risks from cybersecurity threats and adapts and enhances its controls accordingly.


text: Although risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication.


text: Employee Cybersecurity Training. The Company provides ongoing cybersecurity training and compliance programs to facilitate education for employees who may have access to the Company's data and critical systems. Employee phishing tests are conducted on a monthly basis.


text: Engage Third-parties on Risk Management. Periodic external reviews, including penetration tests and security framework assessments, are conducted by auditors, external assessors, and/or consultants to assess and ensure compliance with the Company's information security programs and practices. Internal and external auditors assess the Company's information technology general controls on an annual basis.


text: Oversee Third-party Risk. The Company has a third-party management risk program to help monitor and reduce risks associated with the Company's vendors, which includes processes such as completing due diligence on third party service providers before engaging with them for their services; assessing the third party's cybersecurity posture by reviewing audit reports of the third party, completing cyber questionnaires, and reviewing applicable certification; including cybersecurity contractual language in contracts to limit risk; and monitoring and reassessing third party's to ensure ongoing compliance with their cybersecurity obligations.


text: Other Risk Factors. See the risk factor "Technology disruptions or cyberattacks could adversely impact operations" in the section entitled "Item 1A. Risk Factors - Operations, Growth and Competitive Risks."


text: The board, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implement by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of the Company is responsible for oversight of risks from cybersecurity threats.


text: Management's Role Managing Risk. The vice president of support services plays a large role in informing the audit committee on cybersecurity risks. The audit committee receives presentations and reports from the vice president of support services on cybersecurity related issues which include information security, technology risks and risk mitigation programs regularly at the quarterly board meetings. In addition to scheduled meetings, the vice president of support services and audit committee maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.


text: Cybersecurity Incident Response. The Company has an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents that is also tested on an annual basis. The incident response plan is updated based on results of the test or as new cyber related developments occur. The incident response plan indicates the vice president of support services, executive leadership which includes the chief executive officer, chief financial officer, chief accounting officer, chief legal officer, corporate controller and the board of directors are to be notified of any material cybersecurity incidents through a defined escalation process. The defined escalation process is a risk-based process that specifies who is to be contacted and when at each risk level.


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks. The Company's vice president of support services, along with the supervisor of cybersecurity, a designated security team of professionals and third-party cybersecurity experts are responsible for assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats faced by the Company. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.