text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. The Company has an enterprise risk management ("ERM") program to identify, evaluate, and manage risks, including cybersecurity risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program. The Company believes that integrating cybersecurity risks into its ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the Company's operations, financial condition, and reputation in an ever-evolving threat landscape. Atleos' ERM programs support the Company's strategic objectives and corporate governance responsibilities. The ERM programs include the following primary objectives: • Establish a standard risk framework and supporting policies and processes to identify, assess, respond to, and report on business risks and opportunities, including cybersecurity threats; • Establish clear roles and responsibilities in support of the Company's risk management activities, including cybersecurity; • Ensure appropriate independent oversight of business risks and opportunities and the impacts of related business decisions on the Company's risk profiles and tolerances; • Ensure appropriate communication and reporting of business risks and opportunities including related response strategies and controls to Atleos' executive leadership and Board of Directors; and • Provide relevant training to executives, managers and employees.

companyName: NCR Atleos Corp

ticker: NATL


text: We utilize various information technology and data protection services to help detect and prevent cyberattacks, including but not limited to firewalls, intrusion prevention systems, denial of service detection, anomaly based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, multiple threat intelligence services, threat hunting managed security service provider (MSSP), identity management technology, security analytics, multi-factor authentication and encryption. There can be no assurance that our protections will always be successful and any failure could result in loss, disclosure, theft, destruction or misappropriation of, or access to, our confidential information and cause disruption of our business, damage to our reputation, legal exposure and financial losses.

secItem: Item 1C


text: The Company has also established relationships with cybersecurity firms and internal cybersecurity experts, which it engages in connection with certain suspected incidents. The Company also regularly undergoes evaluation of its protections against incidents, including both self-assessments and expert third-party assessments, and it regularly enhances those protections, both in response to specific threats and as part of the Company's efforts to stay current with advances in cybersecurity defense.


text: To further our commitment to data privacy and cybersecurity: • Atleos maintains the ISO 27001 certification for certain locations throughout the United States, Europe, Australia, and India; • Third-party audits for PCI-DSS, PA-DSS and SSAE-18 SOC2 are conducted for certain service offerings; • Atleos engages third party experts to perform penetration tests to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K; • Atleos maintains a robust information security awareness and training program. Employees and contingent workers are required to complete training within 30 days of hire, as well as an annual refresher course; • Atleos performs regular testing to help ensure employees can identify email "phishing" attacks; and • Atleos' corporate insurance policies include certain information security risk policies that cover network security, privacy and cyber events.


text: As part of our overall ERM approach, our third-party risk management program is designed to ensure proper risk identification and oversight of Atleos' vendors and includes the following objectives: • Perform risk-based segmentation and prioritization of all existing and new Atleos vendors; • Perform sanctions screenings on all vendors and anti-bribery, anti-corruption screenings on applicable vendors; • Perform extended due diligence on identified high risk vendors to include responsible sourcing, business continuity, information security, data privacy, and other reviews as applicable; and • Perform a financial risk assessment on identified high risk vendors The Company also employs advanced screening and due diligence processes and tools, including data privacy and cybersecurity specific evaluations as applicable, as part of our standard third-party onboarding and continuous monitoring processes.


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. For a detailed discussion of the Company's cybersecurity related risks, see "Item 1.A Risk Factors—Data protection, cybersecurity and data privacy issues could adversely impact our business."


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit Committee of the Board has oversight responsibility for the Company's Enterprise Risk Management (ERM) framework, including managing cybersecurity threat risks and cybersecurity incidents. Specifically, the Audit Committee oversees the design, implementation and maintenance of an effective ERM framework for the Company's overall operational, information security, strategic, reputational, technology, and other risks. To fulfill its oversight responsibility, the Audit Committee also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company. The Audit Committee also regularly receives management reports on information security and enhancements to cybersecurity protections, including benchmarking assessments, which it then shares with the Board. Included among the members of both the Board and the Audit Committee are directors with substantial expertise in cybersecurity matters, and Board members actively engage in dialogue on the Company's information security plans, and in discussions of improvements to the Company's cybersecurity defenses. When, in management's or the Board's judgment, a threatened cybersecurity incident has the potential for material impacts, management, the Board and applicable committees of the Board will engage to assess and manage the incident.


text: As discussed below, members of management report to the Audit Committee which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: At the management level, Atleos also established the Office of Risk Management and appointed a Chief Risk Officer to assist the Company in fulfilling its objectives relating to enterprise risk management (ERM), ethics & compliance (E&C), data privacy, third-party risk management (TPRM), business continuity planning (BCP) and sustainability. The Company's Chief Risk Officer is responsible for developing and managing formal programs designed to identify, assess and respond to material and emerging risks and opportunities that may impact the achievement of the Company's strategic objectives.


text: Under the direction of Atleos' Chief Security & Cash Operations Officer, the Global Information Security organization is responsible for implementing and maintaining an information security program with the goal to protect information technology resources and protect the confidentiality and integrity of data gathered on our people, partners, customers, and business assets. Also, we employ various information technology and protection methods designed to promote data security including firewalls, intrusion prevention systems, denial of service detection, anomaly-based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, identity management technology, security analytics, multi-factor authentication and encryption. In addition to the Chief Risk Officer, our Chief Compliance Officer has a direct channel to the Board. Further, our Chief Compliance Officer oversees investigations pertaining to fraud, conflicts of interest, violations of laws, and other similar matters, and reports on those activities to one or more Committees of the Board. All of these channels to the Board are designed to: prevent risks and initiatives from being siloed into one channel and provide a clear and accurate picture of the Company's evolving risk landscape.


text: Our Chief Risk Officer has 20+ years of experience developing and leading global risk organizations across multiple Fortune 500 companies. He holds an undergraduate degree in aerospace engineering from the Georgia Institute of Technology.


text: Our Chief Compliance Officer has 40+ years of experience leading global legal and compliance departments. He holds an undergraduate degree in economics from the Wharton School of Business and a Juris Doctor from Columbia University School of Law.


text: Our Chief Security and Cash Operations Officer has extensive expertise in a wide array of information and physical security operations, emphasizing threat and vulnerability management, malware protection and cyber forensics. He has served in various security leadership roles and holds multiple patents for systems and methods related to information security risk assessment. He holds a bachelor's degree from Midwestern State University.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. The Company has an ERM program to identify, evaluate, and manage risks, including cybersecurity risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program. The Company believes that integrating cybersecurity risks into its ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the Company's operations, financial condition, and reputation in an ever-evolving threat landscape. Atleos' ERM programs support the Company's strategic objectives and corporate governance responsibilities. The ERM programs include the following primary objectives: • Establish a standard risk framework and supporting policies and processes to identify, assess, respond to, and report on business risks and opportunities, including cybersecurity threats; • Establish clear roles and responsibilities in support of the Company's risk management activities, including cybersecurity; • Ensure appropriate independent oversight of business risks and opportunities and the impacts of related business decisions on the Company's risk profiles and tolerances; • Ensure appropriate communication and reporting of business risks and opportunities including related response strategies and controls to Atleos' executive leadership and Board of Directors; and • Provide relevant training to executives, managers and employees.


text: As part of our overall ERM approach, our third-party risk management program is designed to ensure proper risk identification and oversight of Atleos' vendors and includes the following objectives: • Perform risk-based segmentation and prioritization of all existing and new Atleos vendors; • Perform sanctions screenings on all vendors and anti-bribery, anti-corruption screenings on applicable vendors; • Perform extended due diligence on identified high risk vendors to include responsible sourcing, business continuity, information security, data privacy, and other reviews as applicable; and • Perform a financial risk assessment on identified high risk vendors.


text: The Company also employs advanced screening and due diligence processes and tools, including data privacy and cybersecurity specific evaluations as applicable, as part of our standard third-party onboarding and continuous monitoring processes.


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. For a detailed discussion of the Company's cybersecurity related risks, see "Item 1A. Risk Factors—Data protection, cybersecurity and data privacy issues could adversely impact our business."


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit Committee has oversight responsibility for the Company's ERM framework, including managing cybersecurity threat risks and cybersecurity incidents. Specifically, the Audit Committee oversees the design, implementation and maintenance of an effective ERM framework for the Company's overall operational, information security, strategic, reputational, technology, and other risks. To fulfill its oversight responsibility, the Audit Committee also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company. The Audit Committee also regularly receives management reports on information security and enhancements to cybersecurity protections, including benchmarking assessments, which it then shares with the Board.


text: Included among the members of both the Board and the Audit Committee are directors with substantial expertise in cybersecurity matters, and Board members actively engage in dialogue on the Company's information security plans, and in discussions of improvements to the Company's cybersecurity defenses. For example, a member of our audit committee has recently completed executive training at MIT in artificial intelligence and was a former chief executive officer and director of a publicly listed global software company that has an array of products including compliance and cybersecurity related software. He also served as the chair of the compliance and risk committee (including cyber security) at another public company. Additionally, another member of our audit committee recently completed an online course on boardroom governance in cybersecurity. When, in management's or the Board's judgment, a threatened cybersecurity incident has the potential for material impacts, management, the Board and applicable committees of the Board will engage to assess and manage the incident.


text: As discussed below, members of management report to the Audit Committee, which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: At the management level, Atleos also established the Office of Risk Management and appointed a Chief Risk Officer to assist the Company in fulfilling its objectives relating to ERM, ethics & compliance (E&C), data privacy, TPRM, BCP and sustainability. The Company's Chief Risk Officer is responsible for developing and managing formal programs designed to identify, assess and respond to material and emerging risks and opportunities that may impact the achievement of the Company's strategic objectives.


text: Under the direction of Atleos' CISO, the Global Information Security organization is responsible for implementing and maintaining an information security program with the goal to protect information technology resources and protect the confidentiality and integrity of data gathered on our people, partners, customers, and business assets. Also, we employ various information technology and protection methods designed to promote data security including firewalls, intrusion prevention systems, denial of service detection, anomaly-based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, identity management technology, security analytics, multi-factor authentication and encryption. In addition to the Chief Risk Officer, our Chief Compliance Officer has a direct channel to the Board. Further, our Chief Compliance Officer oversees investigations pertaining to fraud, conflicts of interest, violations of laws, and other similar matters, and reports on those activities to one or more Committees of the Board. All of these channels to the Board are designed to: prevent risks and initiatives from being siloed into one channel and provide a clear and accurate picture of the Company's evolving risk landscape.


text: Our Chief Risk Officer has over 20 years of experience developing and leading global risk organizations across multiple Fortune 500 companies. He holds an undergraduate degree in aerospace engineering from the Georgia Institute of Technology.


text: Our Chief Compliance Officer has over 40 years of experience leading global legal and compliance departments. He holds an undergraduate degree in economics from the Wharton School of Business and a Juris Doctor from Columbia University School of Law.


text: Our CISO has over 25 years of experience leading global teams across a variety of IT disciplines as well as executive leadership of global Information Security / Cybersecurity organizations in complex, regulated environments. He holds an undergraduate degree in business administration from Appalachian State University.


text: We rely on the cybersecurity strategy and policies implemented by Oaktree. Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree's overall risk management processes and focuses on the corporate information technology environment. The audit committee of the board of directors of Brookfield Oaktree Holdings, LLC oversees Oaktree's cybersecurity program. The cybersecurity team briefs the audit committee of Brookfield Oaktree Holdings, LLC on the effectiveness of Oaktree's cyber risk management program. The Internal Audit team also shares the results of its annual cybersecurity audits with the audit committee of Brookfield Oaktree Holdings, LLC.

companyName: Oaktree Gardens OLP, LLC


text: The underlying controls of the cyber risk management program are designed to meet Oaktree's business requirements, security risks and organization profile, and leverages many elements of the National Institute of Standards and Technology Cybersecurity Framework and the International Organization Standardization 27001 Information Security Management System Requirements. The Internal Audit team conducts an annual internal audit of the Company's cyber risk management program utilizing the services of a third-party provider. Additionally, Oaktree hires a third party provider to conduct an annual penetration test of Oaktree's systems. Oaktree has developed and implemented controls and processes to oversee and manage its engagements with third-party vendors. These procedures encompass pre-engagement due diligence efforts and the ongoing monitoring of the third-party vendors that are considered to be high-risk. Although these controls and processes are designed to mitigate risks associated with third-party engagements, they do not guarantee the elimination of all potential risks. The effectiveness of these controls and processes is dependent on a variety of factors, some of which are outside Oaktree's and our control.


text: A third party Managed Security Service Provider manages Oaktree's Security Operations Center to provide 24/7 monitoring of its global systems and to coordinate the investigation of alerts of potential security incidents. Alerts are then escalated to the Oaktree Cybersecurity team for investigation and remediation, if necessary. Cyber partners are a key part of Oaktree's cybersecurity infrastructure. Oaktree partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Oaktree engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Oaktree's environment. A Managing Director in Oaktree's information technology department heads Oaktree's cybersecurity team. This individual reports to Oaktree's Chief Information Officer. and is responsible for assessing and managing Oaktree's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of collective experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public and private sources, including external consultants engaged by Oaktree.


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 30 years in managing global IT operations in a wide range of areas, including cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.


text: Our board of directors oversees our cybersecurity program and receives quarterly updates from the cybersecurity team on matters including Oaktree's cyber risk management program (and risks to us related to cybersecurity) and updates to the cybersecurity program, including active and recently completed initiatives.


text: We and Oaktree face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition or results of operations. We and Oaktree have experienced, and will continue to experience, cyber incidents in the normal course of its business. However, we are not currently aware of any current or past cyberattacks or other incidents that, individually or in the aggregate, have materially affected, or are reasonably likely to materially affect, our business, financial condition or results of operations. See "Risk Factors – Market, Legal and Regulatory Risks – We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information."


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 25 years in managing global IT operations in a wide range of areas, including cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.


text: We rely on the cybersecurity policies and procedures implemented by New Mountain Capital. New Mountain Capital has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to New Mountain Capital's Information Security Program, the New Mountain Capital Information Technology Steering Committee ("ITSC") is responsible for the development, evolution, and implementation of policies and technical measures to reasonably prevent security incidents. At times New Mountain Capital may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: New Mountain Guardian IV Income Fund, L.L.C.


text: New Mountain Capital uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, New Mountain Capital uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, New Mountain Capital also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected. New Mountain Capital also requires that all employees, including employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A.—Risk Factors—Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above Governance


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of directors on developments to the information security and cybersecurity risks we face. Reports include, among other things, an overview of New Mountain Capital's controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A.—Risk Factors—Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above Governance


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Adviser and its affiliates. To mitigate risk from cyber threats, our Adviser has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Commercial Real Estate Finance Trust, Inc.


text: Our Adviser's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in specializing in information security and risk management. Our Adviser's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.


text: Our Adviser's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party incident. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: Important to these programs is our Adviser's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.


text: Our Board of Directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO or designee regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our company's enterprise risk management committee, which in turn provides quarterly updates to our Board of Directors, and members of our management team are included in our Adviser's incident response process in the event a cyber security incident occurs that could materially impact us.


text: As of December 31, 2023, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Adviser and its affiliates. To mitigate risk from cyber threats, our Adviser has a designated Global Chief Security Officer ("GCSO") who leads its global security department, which is responsible for identifying, assessing and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations and incident response. The global security department oversees, among other things, the following groups across Invesco: Information Security, Strategic Intelligence, Corporate Security, Business Continuity, Crisis Management, Global Privacy Office, Business Security, Projects and Strategy This structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees and critical assets safe, upholding privacy rights, and enabling a secure and resilient business.


text: Our Adviser's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in information security and risk management. Our Adviser's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.


text: Our Adviser's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or a third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness of cyber phishing threats.


text: Our board of directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO (or designee) regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our enterprise risk management committee, which in turn provides quarterly updates to our board of directors, and members of our management team are included in our Adviser's incident response process in the event a cyber security incident occurs that could materially impact us.


text: As of December 31, 2024, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Cybersecurity Risks Cybersecurity Risk Management and Strategy Arcadium Lithium is committed to protecting its information systems and data from unauthorized access, use, disruption, and destruction. Our cybersecurity risk management strategy is designed to detect, assess, and manage cybersecurity risks in an organized and effective manner with active involvement from the board of directors and management. We also endeavor to actively maintain and monitor our cybersecurity program to stay ahead of the emerging cybersecurity threat landscape.

companyName: Arcadium Lithium plc


text: Our cybersecurity program includes the following key elements: • Enterprise Risk Management ("ERM") process to identify and prioritize cybersecurity risks. • Strong cybersecurity program that conforms to the National Institute of Standards and Technology framework, including a zero-trust model, monitoring, and threat intelligence. • Cybersecurity awareness training program to educate employees about risks and how to detect malicious attack attempts. • Cybersecurity Incident Response plan that is tightly integrated with the Global Crisis Management Plan to effectively respond and recover from material incidents. • Risk-based security architecture designed to protect our most critical assets from the most common threats. • Maintenance of a cybersecurity insurance policy.


text: Our ERM program is maintained and overseen by a cross-functional team of business leaders from across the organization. The program incorporates regular sessions to review the Company's overall risk posture, identify new risks and develop mitigation strategies. ERM matters are reviewed with the Risk Council Review Committee and are ultimately overseen by the Audit Committee of the Board of Directors, which regularly meets with and receives guidance and support from the Board of Directors.


text: Board of Directors Oversight of Cybersecurity Risks The Board of Directors is responsible for overseeing Arcadium Lithium's Enterprise Risk Management, which includes cybersecurity reporting.


text: The process includes: • Receipt of regular updates from the Audit Committee of the Board of Directors on the latest cybersecurity risk posture and overall effectiveness of the Company's cybersecurity program. • Independent reviews of the Company's cybersecurity program through the SOX audit process. • Regular discussions about cybersecurity risks at meetings of the board of directors.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our management team has a comprehensive understanding of the Company's cybersecurity posture and associated risks. The team possesses significant expertise and experience to develop, implement and maintain appropriate cybersecurity controls to reduce risk and seek to keep the Company safe from malicious attacks.


text: Furthermore: • Management regularly assesses company risk posture using internal reporting and monitoring tools. • Management develops and implements mitigation strategies that are based on industry best practice. • Management monitors and maintains the effectiveness of the cybersecurity program through penetration testing and regular assessments. The management team also works with external advisors, partners, and auditors for expert guidance on all cybersecurity-related matters. To date, no cyber threats have materially adversely affected the Company.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property and proprietary business information theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; physical damage to utility and transmission infrastructure; and reputational harm. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks. As part of our enterprise risk management program, we consider cybersecurity risks alongside other risks in our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying material cybersecurity threats, assessing their severity, and deploying potential mitigations. We have implemented cybersecurity programs that are tailored to the distinct businesses of our segments.

companyName: Centuri Holdings, Inc.

ticker: CTRI


text: We conduct quarterly cybersecurity reviews with our executive leadership team. The review outlines the state of cybersecurity practices at Centuri through the lens of the NIST Cybersecurity Framework ("NIST CSF"). Details relative to the progress of specific goals and objectives are communicated to ensure alignment with leadership expectations. We have developed policies and implemented procedures to meet the security control objectives provided within the NIST CSF, as well as applicable Centuri policies. Our cybersecurity team performs a variety of internal operational risk assessment activities to track and mitigate risks to the organization. These operational practices cross a variety of management activities, and a list of these activities is maintained in a Cybersecurity Risk Register for tracking the status of risk mitigation activities, as well as the overall maturity of the organization relative to the NIST CSF. We further engage third parties to perform both targeted and holistic evaluations of our cybersecurity practices on a regular basis.


text: Our cybersecurity team performs independent reviews of new vendors whose services may be potentially integrated within our enterprise. As part of a standardized review process, our cybersecurity team maintains a Control Assurance Toolkit to review vendor activities, practices, and controls for alignment with our policies and procedures. Resulting control recommendations are coordinated to ensure appropriate implementation during integration activities.


text: We undertake vulnerability, attack, and penetration testing via a third-party audit. As part of our general control practices, we perform a review of service organizational controls reports for in-scope vendors to ensure adherence to generally accepted cybersecurity practices. Any reported weaknesses and associated responses are captured and evaluated for impact, and subsequently provided to our leadership for review and response.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Our Business and Industry" as part of our risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.


text: The Centuri Cybersecurity Program operates under the auspices of our Board. Management oversight is delegated to our VP of Information Technology, who has over 25 years of industry experience and reports directly to our Chief Legal & Administrative Officer. Operational responsibility for daily cybersecurity activities is managed by our Cybersecurity Manager, who has 25 years of industry experience in information technology, with 15 years focusing on information technology ("IT") risk, security, and compliance. Our Cybersecurity Manager is accountable for the assessment, monitoring, reporting, and mitigation of our cybersecurity risks. Our Cybersecurity Manager is also responsible for identifying and documenting cybersecurity risks, identifying remediation options and activities, ensuring remediation implementation, and providing on-going monitoring for changes in the Company's overarching risk profile. On a quarterly basis, our VP of Information Technology provides a formal cybersecurity update to our Chief Legal & Administrative Officer, which highlights key metrics, events, efforts, risks, and risk mitigation activities. Our VP of Information Technology is also responsible for communicating with our Board regarding cybersecurity risks, providing our Board with regular cybersecurity briefings that facilitate the alignment and prioritization of efforts on the part of our cybersecurity team as instructed by executive leadership.


text: Our Security Incident Response Plan (SIRP) governs the procedure for cybersecurity event escalation and notification practices. The plan uses a methodology that closely follows the "Incident Response Life Cycle" published in NIST 800-61 "Computer Security Incident Handling Guide" to manage cybersecurity incidents. In addition to managing the technical response to cybersecurity incidents using this methodology, this plan also addresses non-technical response requirements. Non-technical responses include engaging the proper Centuri personnel to determine the compliance, regulatory, legal, corporate communication, and other requirements we need to comply with to address the cybersecurity incidents.


text: During a critical cybersecurity event, our Incident Response Team will coordinate with designees from our Disclosure Committee to ensure key details regarding event impact on data, operations, and financials and other attributes of the event are properly communicated. Upon resolution of the event, our IT leadership will compile and retain evidence regarding the event and evaluate it to determine the materiality of the event. In this process, our IT team will provide an overview of the timeline, nature, and severity of impact and highlight the attributes that would aid in the determination of materiality. Our Disclosure Committee is responsible for identifying and communicating with interested parties relative to such an event.


text: We have developed and implemented several cybersecurity risk management measures intended to protect the confidentiality, integrity, and availability of our critical systems and information. We work to continuously refine, strengthen, and supplement these measures.

companyName: Smith Douglas Homes Corp.

ticker: SDHC


text: The Board of Directors and management are committed to enhancing our cybersecurity risk management measures, which are integrated into our enterprise risk management processes and share common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management measures include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, incident response personnel, and senior management. In addition to our internal resources, our cybersecurity risk management leverages external service providers who we work with to identify and oversee cybersecurity risks. For example, during 2024, we engaged an independent third-party assessor to assist management in identifying cybersecurity risks and developing ongoing procedures to enhance our cybersecurity risk management measures. In addition, we use our external providers to assist with endpoint monitoring, alerts, and other security management protocols such as regular backups and encryption.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents such as phishing attacks and other email compromises, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has received briefings from management in the past as appropriate (for example, regarding the results of our previous cybersecurity risk assessment and ongoing enhancement efforts with the involvement of a third-party assessor). Our audit committee oversees management's implementation of our cybersecurity risk management program.


text: Our management team, including the Vice President of IT and the Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of IT, Randy Jepsen, oversees infrastructure, procurement, development, and IT support, with over 25 years of experience in the IT industry and 19 years at Smith Douglas and The SMART Builder Solutions designing and enhancing internal enterprise applications. Our Chief Financial Officer, Russell Devendorf, previously oversaw the information technology and risk management functions of a publicly traded homebuilder from 2008 to 2017, overseeing the company's cybersecurity program and the implementation of an incident response plan and cybersecurity insurance. As a result, our management team's cybersecurity experience includes previous combined experience of almost 50 years managing and otherwise engaged with IT and internal audit functions at public companies overseeing the development and strengthening of cybersecurity programs inclusive of training, risk assessments, and formal policies and procedures.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment. Our management team provides regular updates to our audit committee regarding the results of our cybersecurity risk assessment measures and associated enhancement actions.


text: The Company and the broader financial services industry face an increasingly complex and evolving threat environment.

companyName: LGAM Private Credit LLC


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Adviser and the Administrator manage the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and stockholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley forensics team, which develops and implements technologies designed to help detect these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Where a potential threat is identified in Morgan Stanley's environment or which impacts the Company, Morgan Stanley's incident response team evaluates the potential impact to the Firm and, as relevant, the Company, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department, review external cybersecurity incidents that may be relevant to the Firm and the Company, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular training exercises for its employees and consultants, including those personnel relied upon by the Company.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Risk, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company. Those processes are periodically tested through tabletop exercises.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally and relies on the CIO, CISO, and Head of Operational Risk to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of Operational Risk has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of Operational Risk report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to the Company Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, the CISO, and the Head of Operational Risk, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2023, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its unitholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and unitholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to the Firm and the Company, to further inform the design of the Cybersecurity Program. To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to the Firm and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk, ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, CISO, and/or Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and Board, as appropriate. The BOTC has primary responsibility for assisting the Morgan Stanley board in its oversight of significant operational risk exposures of the Firm and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.


text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the Gramm-Leach-Bliley Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the Morgan Stanley board and, in accordance with such board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the Morgan Stanley board on cybersecurity risks and threats and other related matters.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2024, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Through its Manager, the Fund maintains a cybersecurity risk management program designed to identify, assess, manage, and mitigate threats, as well as respond to and recover from cybersecurity incidents. This program is coupled with an enterprise risk management program and covers the Fund's key information systems.

companyName: WTI Fund XI, Inc.


text: The cybersecurity risk management program includes a comprehensive risk assessment that is applicable to the Fund's operations. This assessment is based on recognized standards for cybersecurity and information technology as set forth in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). It is reviewed and updated at least annually. Internal controls designed to mitigate risks presented in the assessment are tested annually by an independent third party. Additionally, the Manager, on behalf of the Fund, contracts with a qualified third party to perform annual assessments of the Company's cybersecurity risk management program and to perform cybersecurity risk evaluations of selected key vendors. Another third party is engaged to provide day to day IT services which include implementing, monitoring, and maintaining the preventative and detective measures specified as part of the Fund's cybersecurity risk management program.


text: The Manager's Chief Compliance Officer led the development and oversees the implementation of the cybersecurity program, and is the head of the Manager's cybersecurity team, supported by the Director of Compliance. The Chief Compliance Officer is responsible for assessing and managing the Manager's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team, inclusive of all third parties engaged to provide operations, monitoring, detection, and remediation, has extensive experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes.


text: The Audit Committee of the Board of Directors oversees the Fund's cybersecurity risk exposures and the steps taken by management to monitor and mitigate identified risks. The Chief Compliance Officer briefs the Audit Committee on the effectiveness of the cyber risk management program at least on a quarterly basis. In addition, cybersecurity risks and cyber incidents, if any, are reviewed by the Fund's Board of Directors at least annually as part of the risk mapping exercise, or as warranted in the event of material incidents.


text: The Fund faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. See "Risk Factors – Risks Related to Cybersecurity" for further information on how our operations are subject to cyber incidents that could have a material adverse effect on our business, financial condition, results of operations, or cash flows.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy and policies implemented by the Adviser and HPS, the providers of our technology services. The Adviser manages our day-to-day operations and has implemented, together with HPS, a firm-wide cybersecurity program that applies to us and our operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by HPS, and (ii) any actions of the Adviser shall be deemed to refer to actions of HPS and/or the Adviser, as the context may require.

companyName: HPS Corporate Capital Solutions Fund


text: The Adviser's cybersecurity program prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact us. The Adviser's cybersecurity program is aligned to the Center for Internet Security critical controls framework. The Adviser's cybersecurity risk management processes applicable to us include technical security controls, policy enforcement mechanisms, monitoring systems, and other tools. Third-party providers are leveraged to assist in assessing, identifying and managing risks from cybersecurity threats applicable to us. The assessment of cybersecurity risks, including those which may be applicable to us, is integrated into the Adviser's overall risk management program. The Adviser has implemented and continues to implement risk-based controls designed to prevent, detect, and respond to information security threats and we rely on such controls.


text: The Adviser's cybersecurity program includes physical, administrative, and technical safeguards, as well as plans and procedures designed to help us prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact us. The Adviser's cybersecurity risk management processes seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat, and mitigate such threats. We rely on the Adviser to engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity program and risk management processes and responding to incidents.


text: The Adviser's cybersecurity risk management and awareness programs, which apply to us, include identification and testing of vulnerabilities, phishing simulations and cybersecurity awareness training. The Adviser undertakes internal security reviews of its information systems and related controls, including those applicable to us. The Adviser also completes external reviews of the cybersecurity program and practices applicable to us, which may include assessments of relevant data protection practices and targeted attack simulations.


text: The Adviser has developed an incident response plan that provides guidelines for responding to cybersecurity incidents. The incident response plan includes notification to the applicable members of cybersecurity leadership, including the Adviser's Chief Information Security Officer ("CISO"), and, as appropriate, escalation to other relevant individuals. Incidents may also be reported to the audit committee or full board of directors of the Adviser, as well as to the Audit Committee, if appropriate.


text: Our m anagement is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with the Adviser's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate our business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or that are reasonably likely to materially affect us, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: Management's Role in Cybersecurity Risk Oversight The Adviser's CISO and dedicated internal cybersecurity team are responsible for the cybersecurity program applicable to us (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes). Our Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the board about the Adviser's compliance with its responsibilities for the Adviser's and our cybersecurity program. The Adviser's CISO has over 15 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures in both US Government Intelligence agencies and Financial Services firms. The Adviser's CISO reports to the Chief Financial Officer of the Adviser and works closely with our management to administer, assess, discuss, and prioritize our cybersecurity efforts. Our CCO has been responsible for this monitoring and reporting as CCO to us for 3 years and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risks applicable to us.


text: Board Oversight of Cybersecurity Risks The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. Certain of our members update the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by our CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to us, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our overall risk management systems. These risks include, among other things: operational risks, encryption, intellectual property theft, fraud, extortion, harm to employees or other stakeholders, and violation of data privacy or security laws.

companyName: T1 Energy Inc.

ticker: TE


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes, which includes employee training on awareness and identifying cybersecurity threats. Cybersecurity risks related to our business, technical operations, privacy, and compliance activities are identified and addressed through our risk control process and through our monthly security meetings where we address the threat landscape, including risks related to our third-party service providers. We use an external cybersecurity firm and cybersecurity experts to provide various services to supplement our internal personnel and expertise.


text: We have implemented a program for incident response and breach management as part of our crisis management process, and we perform tabletop exercises for cyber incidents with the crisis management team. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational, business, and privacy impacts.


text: The Audit and Risk Committee (the "ARC") has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The ARC reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration. Management regularly discusses cyber risks and trends and, should they arise, any material incidents with the ARC. Members of management overseeing cybersecurity threats, including our Chief Digital Officer and Chief Information Security Officer have experience in areas including management of information technology, data security, and cybersecurity.


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. See also the cybersecurity-related risks in Item 1A "Risk Factors."


text: The Audit and Risk Committee (the "ARC") has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The ARC reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration. Management regularly discusses cyber risks and trends and, should they arise, any material incidents with the ARC. Members of management overseeing cybersecurity threats report to our Chief Executive Officer and have experience in areas including management of information technology, data security, and cybersecurity.


text: Cybersecurity Risk As a fully integrated electric and gas utility, we operate and participate in regional markets and are interconnected with other entities. The operation of these systems depends on information technology systems we own and operate as well as third party systems and service providers. Strategic business partners are also leveraged to support our mission. As an operator of critical infrastructure, nefarious actors may find us a valuable target if they wish to disrupt our operations and negatively impact our customers. The systems and partnerships described above are all potential targets for a cyber-incident. Any significant interruption or failure of our information systems due to cyber-attacks, hacking or internal security breaches could prevent us from fulfilling our critical business functions including delivering energy to our customers, and sensitive, confidential, and other data could be compromised. This could adversely affect our business, our financial condition, operating results or liquidity. For the year ended December 31, 2023, there have been no cybersecurity incidents with a material impact on our business strategy, operations, or financial condition.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: We utilize a comprehensive, defense in depth approach to cybersecurity risk, which helps us to continually assess, identify and manage enterprise-wide material cybersecurity risks. Our cybersecurity risk management is integrated into our overall Enterprise Risk Management (ERM) process and is reviewed at least quarterly. Our cybersecurity strategy focuses on maintaining the confidentiality, integrity and availability of data. We leverage frameworks established by the National Institute of Standards and Technology and the Center for Information Security for our information and cybersecurity governance program. We have a comprehensive cybersecurity threat detection and monitoring program for our technology and network infrastructure, which leverages various systems, processes, and operational measures to monitor, detect, and respond to cyber incidents. Our cybersecurity processes, including our threat detection, monitoring, and response protocols are subject to ongoing vulnerability testing, and comparison to industry practices. An Incident Response and Disaster Recovery Plan is maintained and periodically exercised. The plan includes a process to identify, protect, detect, respond to and recover from cybersecurity threats and incidents. Resiliency and recoverability are paramount in the plan. This includes a clearly defined escalation process within the plan to ensure management and the Board of Directors are notified if an incident or series of events warrant escalation.


text: Our strategy includes employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, modern end point protection against threats, patching strategy, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing.


text: We monitor potential risks associated with the use of third-party service providers and vendors. Our cyber incident monitoring process includes dialog with any third party or business partner potentially impacted by a disclosed incident. Service providers and vendors must adhere to security requirements such as security incident or data breach notification and response protocols, appropriate data encryption requirements, and data disposal. In addition, we engage with third party consultants to perform penetration (PEN) studies. These independent third party assessments provide valuable insight to enhance our cybersecurity posture.


text: Board Governance Our Board of Directors reviews the cybersecurity program through risk review and cybersecurity reporting on at least a quarterly basis. The Audit Committee oversees our ERM program, including cybersecurity protocols. The Safety, Environmental, Technology and Operations (SETO) Committee provides oversight and review of technology policy and strategy as it relates to cybersecurity issues impacting company operations. Both the Audit Committee and the SETO Committee include Directors with diverse experience in technology, finance, enterprise risk, and security providing effective assessment and oversight of cybersecurity risk. Of note, one member of the Board has bolstered their understanding of technology and security issues by obtaining a certificate in cybersecurity oversight.


text: Roles and Responsibilities of Management Our cyber security team, which reports to the Vice President - Technology, has primary responsibility for cybersecurity strategy and assessing cyber risk. The Vice President - Technology is responsible for informing the Chief Executive Officer and other Officers, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the cyber security team. Collectively, our cyber security team has experience in cybersecurity, hold numerous industry certifications related to cybersecurity, and have experience in desktop support, networking, application administration and programming.


text: Cybersecurity Risk As a fully integrated electric and gas utility, we operate and participate in regional markets and are interconnected with other entities. The operation of these systems depends on information technology systems we own and operate as well as third party systems and service providers. Strategic business partners are also leveraged to support our mission. As an operator of critical infrastructure, nefarious actors may find us a valuable target if they wish to disrupt our operations and negatively impact our customers. The systems and partnerships described above are all potential targets for a cyber-incident. Any significant interruption or failure of our information systems due to cyber-attacks or incidents could hinder our ability to fulfill our critical business functions. This could adversely affect our business, our financial condition, operating results or liquidity. Through the year ending on December 31, 2024, there have been no cybersecurity incidents that have had a material impact, or any impact, on our business strategy, operations, or financial condition.


text: We utilize a comprehensive, defense in depth approach to cybersecurity risk, which helps us to continually assess, identify and manage enterprise-wide material cybersecurity risks. Our cybersecurity risk management is integrated into our overall Enterprise Risk Management (ERM) process and is reviewed at least quarterly. Our cybersecurity strategy focuses on maintaining the confidentiality, integrity and availability of data. We leverage frameworks established by the National Institute of Standards and Technology and the Center for Information Security for our information and cybersecurity governance program. We have a comprehensive cybersecurity threat detection and monitoring program for our technology and network infrastructure, which leverages various systems, processes, and operational measures to monitor, detect, and respond to cyber incidents. Our cybersecurity processes, including our threat detection, monitoring, and response protocols are subject to ongoing vulnerability testing, and comparison to industry practices. An Incident Response and Disaster Recovery Plan is maintained and exercised. The plan includes a process to identify, protect, detect, respond to and recover from cybersecurity threats and incidents. Resiliency and recoverability are paramount in the plan. This includes a clearly defined escalation process within the plan to ensure management and the Board of Directors are notified if an incident or series of events warrant escalation.


text: Our strategy includes employee training and awareness on cybersecurity risks and related best practices, simulated phishing campaigns, required password complexity, the use of multi-factor authentication, information security protocols, modern end point protection against threats, patching strategy, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing.


text: As part of engaging a new third party provider, we assess their security standards, require security terms and conditions and work with risk management to ensure insurance coverage is adequate for the exposure risk. Service providers and vendors must adhere to security requirements such as security incident or data breach notification and response protocols, appropriate data encryption requirements, and data disposal. Our cyber incident monitoring process includes dialog with any third party or business partner potentially impacted by a disclosed incident. In addition, we leverage third party consultants to perform penetration (PEN) studies. These independent third party assessments provide valuable insight to enhance our cybersecurity posture.


text: Roles and Responsibilities of Management Our cyber security team, which reports to the Vice President - Technology, has primary responsibility for cybersecurity strategy and assessing cyber risk. The Vice President - Technology is responsible for informing the Chief Executive Officer and other Officers, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the cyber security team. Collectively, our cyber security team holds numerous industry certifications related to cybersecurity and have experience in desktop support, networking, application administration and programming.


text: GE Vernova has processes for assessing, identifying, and managing cybersecurity risks that are built into our risk management program and IT functions. These processes are designed to help protect our information assets from internal and external cyber threats, protect employee information from unauthorized access or attack, and secure our networks, systems, and products. We have developed and implemented a cybersecurity framework intended to assess, identify, and manage risks from threats to the security of our information, systems, products, and networks using a risk-based approach. The framework is informed in part by industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. This approach does not imply that GE Vernova meets all technical standards, specifications, or requirements under the NIST Cybersecurity Framework or ISO 27001.

companyName: GE Vernova Inc.

ticker: GEV