text: We have established a process for management, including our Vice President, Head of Information Technology and Chief Financial Officer, to report to the Audit Committee on potential major cybersecurity risks, their potential impact on us, and the steps we take to manage them. The Audit Committee considers identified cybersecurity risks and the steps that the Company's management has taken to monitor and control such risks in connection with the Audit Committee's discussion of the Company's risk assessment and management guidelines, as appropriate. The Audit Committee has periodically reviewed and discussed the Company's cybersecurity risks, including the Company's information security and risk management programs, controls and procedures, as well as high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential security incidents.


text: Our board of directors oversees management of our cybersecurity risks through the Audit Committee. As needed, the chairperson of the Audit Committee provides updates on the Company's cybersecurity risk program to the full board of directors.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS

secItem: Item 1C


text: We recognize the importance to our business and reputation of the continuous availability of our internal and client-facing information technology systems, as well as our ability to protect both the confidential information of our clients and our own intellectual property and business information. We are committed to protecting our client and business data and information technology assets and have implemented a cybersecurity program with policies, standards, processes and practices governing the protection and control of information during its lifecycle of creation, usage, transmission, storage and disposal.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: Cyber Risk Management and Strategy We have implemented and maintain a risk management program that includes processes for the identification, assessment, management and mitigation of cybersecurity risks. This program utilizes numerous technological and human security controls, processes, and procedures to address risks including, but not limited to, those identified by threat intelligence providers, internal stakeholders, and security management programs. Our cybersecurity program is generally aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: Our risk management program is documented in our written Information Security Policy. We periodically update our Information Security Policy, along with other policies and procedures, to adapt to evolving business conditions and threats.


text: Included in our Information Security Policy is a documented incident response plan to identify, assess, manage and mitigate cybersecurity incidents. As part of our risk management program, we maintain a technology management security team, led by our Information Security Officer (ISO). Among their responsibilities, our technology management security team is responsible for conducting due diligence on software, hardware or services vendors where access to systems or data of Forrester or our clients is contemplated. The security team assesses whether these vendors have appropriate privacy and security controls and whether there are adequate contractual protections in place. We also engage external security assessment vendors from time to time to conduct penetration testing and vulnerability assessments and to report findings to management.


text: All new Forrester employees and contractors receive a copy of the Information Security Policy and are required to undergo information security and privacy training both as part of their onboarding and on an annual basis. We currently also maintain cybersecurity insurance covering the company and its subsidiaries.


text: While to date we are not aware of having experienced any material cybersecurity threats or incidents, and we do not believe that risks from such threats or incidents are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, there can be no guarantee that we will not experience a successful material threat or incident. Additional information on cybersecurity risks we face can be found in "Item 1A, Risk Factors" under the heading "We face risks from network disruptions or security breaches that could damage our reputation and harm our business and operating results."


text: Related to Cybersecurity Risks Our board has final oversight responsibility over cybersecurity-related matters. Our Chief Technology Officer (CTO) leads the full board in interactive sessions dedicated to cybersecurity risks at least once a year. These sessions address a range of cybersecurity-related topics, such as recent developments in the threat environment, the status of ongoing information security program initiatives, and cybersecurity strategy. In addition, the audit committee assists the board in fulfilling its oversight responsibilities with respect to policies relating to risk assessment and management, including the management of risks arising from cybersecurity threats. The audit committee is responsible for reporting findings related to its review of these matters to the board.


text: With respect to management, our CTO, who reports directly to our chief executive officer, has over 12 years of experience with our company, including more than 6 years serving in technology-based leadership roles. Our VP, Infrastructure, Operations & Security, who reports directly to the CTO, serves as our ISO and has extensive cybersecurity experience gained from over 20 years serving in security-related roles for the Company. Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data. If an incident is identified, this team reports such events to the CTO, who will then, as appropriate, advise the chief executive officer, chief legal officer and other management, as well as others, potentially including law enforcement or clients. We have also established a Risk Committee consisting of members of our finance, legal and technology management departments whose duties include assessing the materiality of any identified incidents to help ensure compliance with the SEC's cybersecurity incident disclosure rules.


text: As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior professionals of Onex Credit and each of the Adviser and Administrator is a subsidiary of Onex Corp. As such, we are reliant on Onex Corp. for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Onex Corp. has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Onex Direct Lending BDC Fund


text: Onex Corp. has established a dedicated cybersecurity team which maintains a comprehensive firmwide cybersecurity program to protect its systems, operations and the information stored within. Onex Corp.'s Audit, Nominating and Corporate Governance Committee receives at minimum, quarterly cybersecurity updates from the Managing Director – Enterprise Technology, who leads Onex Corp.'s program and who works closely with senior management to develop and advance Onex's cybersecurity strategy.


text: As part of Onex Corp.'s ongoing cybersecurity operations, the cybersecurity team regularly conducts testing to identify vulnerabilities that could be exploited by attackers often using various automated tools as well as a managed service provider. The team examines and validates the cybersecurity program and cyber risk posture annually with third parties, measuring it against industry standards and established frameworks, such as the National Institute of Standards and Technology ("NIST"), Center for Internet Security and the International Organization for Standardization (ISO). Onex maintains a comprehensive Security Incident Response Policy, an Incident Response Plan, and Incident Response Playbooks to ensure that any non-routine events are properly investigated and escalated where necessary. On an annual basis, these plans, policies and processes are validated and practiced with senior executives and representatives from key areas of the firm through a cyber-incident tabletop simulation exercise. Onex Corp. engages with a Managed Security Services Provider (the "MSSP") who conducts vulnerability scanning and cyber threat intelligence on a weekly basis at minimum. Additionally, third-party cybersecurity consultants are engaged to perform penetration testing on a bi-annual basis. The findings are reviewed, prioritized and remediated in alignment with the recommendations from the external consultant. In addition to Onex Corp.'s cybersecurity team's internal exercises to test aspects of its cybersecurity program, Onex Corp. periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of enterprise information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.


text: Onex Corp. maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Onex Corp.'s cybersecurity management team periodically discusses and reviews cybersecurity risks and related mitigants at its Cybersecurity Excellence Quarterly Forum.


text: Onex Corp. employs a process designed to assess, typically prior to onboarding, the cybersecurity risks associated with the engagement of third-party vendors, including those of its externally managed companies such as us. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Onex Corp. may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Onex Corp. seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Onex Corp. also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Onex Corp. and its affiliates in managing these risks, see "Item 1A. Risk Factors— Risks Related to Our Business and Structure—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Onex Corp. has a dedicated cybersecurity team, led by the Managing Director – Enterprise Technology Services, who works closely with senior management, including Onex Corp.'s Chief Financial Officer, to develop and advance the firm's cybersecurity strategy, which applies to us.


text: The Managing Director – Enterprise Technology and Manager, Cybersecurity has extensive experience in technology and cybersecurity, respectively. The cybersecurity team of Onex Corp. is responsible for all aspects of cyber security across Onex.


text: The Managing Director – Enterprise Technology has 18 years of IT experience across financial services, healthcare and manufacturing industries in Canada including as the VP Financial Crimes and Enterprise Risk Technology at CIBC that provided cybersecurity platforms and services to protect the bank. Reporting to the Managing Director – Enterprise Technology, is the Manager, Cybersecurity who has over 15 years of experience in cybersecurity including Incident Readiness and Response, Strategy, GRC, Vulnerability and Threat Management, Business Continuity, Disaster Recovery. The Manager, Cybersecurity holds the CISSP (Certified Information Systems Security Professional) designation, has a BSc in Business Information Systems, and a Cybersecurity Bootcamp Certification from the University of Toronto. Reporting to the Manager, Cybersecurity is an IT Security Analyst who has over 5 years of experience in cybersecurity, including Digital Forensics, Identity and Access Management, Third-Party Risk Management. The IT Security Analyst also has a BSc in Forensic Science, an MSc in Information Security and Digital Forensics, and is currently pursuing a PHD in Information Systems and Design.


text: Onex Corp. conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The cybersecurity team of Onex Corp. reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. Onex Corp.'s cybersecurity team and Onex Corp.'s MSSP also review the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Onex Corp.'s and its affiliates' information and systems.


text: Our Board is responsible for understanding the primary risks to our business. The Board is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Onex Corp.'s cybersecurity team reports to the Board at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board or a committee thereof may receive updates from management as to our and the Adviser's cybersecurity risks and Onex Corp.'s cybersecurity program developments.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Risks Related to Our Business and Structure— We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information."


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO") with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Ethereum Classic Trust (ETC)

ticker: ETCG


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Sponsor's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board about any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engage s personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats at the Sponsor or the Trust that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


companyName: Grayscale Zcash Trust (ZEC)

ticker: ZCSH


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: We recognize the critical importance of protecting our information technology ("IT") systems and the data of our employees, customers, patients, and partners. We have an enterprise-wide cybersecurity program designed to identify, detect, investigate, protect, and respond to cybersecurity risks.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: The Nominating and Corporate Governance Committee of the Board of Directors oversees our cybersecurity programs and cybersecurity team, which are led by our Vice President of Information Technology. At least semi-annual reviews are presented by the Vice President of Information Technology to the Nominating and Corporate Governance Committee demonstrating the cybersecurity practices and controls, mitigation activities, current threat levels, emerging cybersecurity threats, training initiatives, breaches, and results from any penetration testing. In addition, cybersecurity risk management is part of the enterprise risk management program and is reviewed by the Audit Committee at least annually.


text: We have developed an information security policy ensuring that our cybersecurity objectives are established and compatible with our strategic direction. The goal of this policy is to protect our informational assets against reasonably foreseeable internal, external, and accidental threats. Identifying and assessing cybersecurity risk is integrated into our overall risk management processes. Cybersecurity risks related to our business, operations, privacy, and compliance are identified and managed through third party assessments, internal IT audits, governance, risk and compliance reviews.


text: Our policies and approach to cybersecurity include several key elements: • Continuous Monitoring and Defense: We work to protect our environments and products from threats through multi-layered defenses. We utilize data analytics to detect anomalies and search for cyber threats. Our Security Operations Center provides comprehensive, around the clock, cyber threat detection and response capabilities. • Third-Party Software Risk Assessment: W e complete security audits on all third-party platforms prior to selection. • Incident Response Plan: Our Incident Response Plan includes the investigation steps and notifications required on all actual and suspected information security incidences • Cybersecurity Training Programs: Our training program is multi-faceted and focused on awareness of new techniques that threat actors utilize both in the corporate environment, as well as their personal lives. Employees undergo regular training on information security best practices, including interactive training to confirm understanding and test employee skills. • Compliance Policy: Mandatory compliance with all cybersecurity programs, including applicable legislative and regulatory requirements. • Third-Party Cybersecurity Plan Assessment: We regularly engage with cybersecurity professionals in reviewing our cybersecurity plan.


text: To date, the Company is not aware of any cybersecurity threats, including any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, as discussed under the heading, "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our customer's patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation" in Part I, Item 1A, "Risk Factors," the Company remains subject to evolving cybersecurity risks that could have adverse impacts.


text: We have established policies and processes designed to assess, identify, and manage material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We monitor our environments to identify cybersecurity threats, as well as assess our environments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: Following our monitoring, we adjust, implement and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Officer, who reports to our Chief Financial Officer and Chief Operating Officer, to manage any identified risks and mitigation process. As part of our overall cyber security framework, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our information technology (IT) department and management. Personnel at all levels and departments are made aware of our cybersecurity policies through ongoing training.


text: We engage third-party vendors in connection with our cybersecurity risk monitoring and processes. These service providers assist in our design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks.


text: Notwithstanding any of these measures, our systems and networks remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cybersecurity threats, please see the risk factor titled, "If our security measures are compromised, or our information technology systems or those of our vendors, and other relevant third parties fail or suffer security breaches, loss or leakage of data, and other disruptions, this could result in a material disruption of our services, compromise sensitive information related to our business, harm our reputation, trigger our breach notification obligations, prevent us from accessing critical information, and expose us to liability or other adverse effects to our business." in Item 1A. "Risk Factors."


text: The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives status updates on at least a semi-annual basis from our Chief Information Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Audit Committee. In addition, all Board members have access to the materials for each Audit Committee meeting.


text: Our Chief Information Officer is responsible for the oversight of our cybersecurity risks. We have implemented a security incident response plan and use this incident response framework as part of the process we employ to keep the Audit Committee and our executive management informed about cybersecurity risks and to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The plan is a set of procedures and tasks that our incident response team, under the direction of the Chief Information Officer, executes with the goal of ensuring timely identification and appropriate resolution of cybersecurity incidents. In addition, we validate compliance with our internal data security controls through the use of security monitoring tools.


text: Our Chief Information Officer has over 25 years of IT experience and has a thorough understanding of enterprise level cyber security framework. Our Chief Information Officer has also participated in cybersecurity reviews and implementations including various tools and platforms for over 10 years and drives strategic cyber security implementations based on industry best practices that helps us strengthen our security posture on a continuous basis.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Unity Biotechnology, Inc.


text: We design and assess our cybersecurity program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Head of Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Legal Officer and Head of Operations and external IT consultants, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Legal Officer is a former federal prosecutor and deputy chief of cybercrime in the U.S. Attorney's Office for the Eastern District of Virginia, as well as a former law firm partner conducting and overseeing investigations, prosecutions, and cases relating to cybercrime, hacking, trade secrets, large-scale identity theft, national security, data breaches, and related cybersecurity and data privacy matters. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience, in close cooperation with external IT consultants, includes significant experience of leading and managing IT infrastructure and security operations teams for various sized global companies across several different industries.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company's Board of Directors (the "Board") recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are integrated into the Company's ERM program In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of its systems and the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EQUITY BANCSHARES INC

ticker: EQBK


text: Due to our heavy reliance on the strength and capability of our technology systems, which we use both to interface with our customers and to manage our internal financial reporting and other systems, we utilize a layered cybersecurity model designed to protect Company systems and sensitive data. This defense model is composed of a variety of different components including administrative, technical controls and safeguards. These various components are centrally managed and monitored creating a multi-layered, interlocking, cybersecurity defense system. We believe this defense system is dynamic and designed to adjust to protect against the latest cyber threats and attack vectors.


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program and strategy is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Risk Management Committee of the Board (the "Risk Management Committee"), which regularly interacts with the Company's ERM function, the Company's Chief Information Security Officer ("CISO"), the Company's Chief Information Officer ("CIO"), other members of management. • Incident Response and Recovery Planning: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that establish a structured approach for the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Outside Experts. The Company routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reviewed by the Cybersecurity team and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Board Oversight of Risks from Cybersecurity Threats The Board, in coordination with the Risk Management Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Risk Management Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Risk Management Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Risk Management Committee discuss the Company's approach to cybersecurity risk management with the Company's CISO and CIO.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant. For more information on the Company's cybersecurity-related risks, see "Item 1A - Risk Factors - We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our or our customers' confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers."


text: Risks from Cybersecurity Threats The CISO, in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and CIO monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Management Committee when appropriate.


text: The CISO has served in various roles in information technology and information security for over 15 years, including serving as the Chief Information Security Officer of two large public companies. The CISO holds an undergraduate degree in Information Networking and Telecommunications, a graduate degree in Cybersecurity, and has attained the professional certification of Certified Information Systems Security Professional. The CIO holds an undergraduate degree in Business Finance and has served in various roles in information technology for over 30 years, including serving as either the Chief Information Security Officer or Chief Information Officer of two public companies.


text: Our board of directors and management exercise oversight over our cybersecurity program, which represents an important component of our overall approach to enterprise risk management.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: Teknova's Vice President of Information Systems and Architecture (VP of IT) manages a team responsible for leading enterprise-wide strategy, policy, standards, architecture, processes, and risk assessment related to information security and data protection, including data privacy and network security (our Cybersecurity Program). The VP of IT has served in various roles in information technology and information security, along with other members of the IT department, and holds relevant and applicable certifications. The VP of IT reports directly to our Chief Executive Officer and provides periodic reporting on our Cybersecurity Program to our senior management team, our board of directors, and the audit committee of our board of directors.


text: Our board of directors, in coordination with our audit committee, oversees our management of cybersecurity risk, with the audit committee reviewing and discussing with management matters related to our Cybersecurity Program, including as it relates to financial reporting. The board of directors and audit committee receive periodic reports about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Additionally, risks associated with the Cybersecurity Program are integrated into our enterprise risk management assessment and reported to our Board as needed. We also share the key results of third-party assessments with our board of directors and audit committee.


text: Technical Safeguards As part of our Cybersecurity Program, we deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Our Cybersecurity Program also includes a periodic risk assessment, which is based generally on frameworks established by the National Institute of Standards and Technology (NIST).


text: We also maintain procedures designed to identify and mitigate cybersecurity threats related to our use of material third-party vendors. This includes reviewing the internal controls of certain third-party service providers to assess their procedures to mitigate material cybersecurity risks, among other risks.


text: We have an information security incident response process to prevent, detect, mitigate, and remediate cybersecurity incidents and threats. This process includes controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management in a timely manner, with appropriate involvement by our board of directors.


text: External Assessments We obtain periodic assessments by third party experts of our vulnerability management and security controls and to assist us in identifying and mitigating security risks.


text: Education and Awareness We provide periodic cybersecurity training for all officers and employees as well as periodic additional training for senior management through our cyber insurance carrier.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations, or financial condition. For information regarding cybersecurity risks that may materially affect our Company, see the risk factor titled "Our internal computer systems, or those of our suppliers, customers, or contractors, have been and may in the future be subject to cyberattacks or security breaches, which could result in a material disruption of our business or otherwise adversely affect our business, financial condition, results of operations, cash flows, and prospects." under "Risk Factors" in Part I, Item 1A. to this Annual Report on Form 10-K.


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company works with third party companies to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: The Company recognizes the importance of maintaining our technology and data systems. Our cybersecurity policies, standards, processes, and practices are integrated across our operational departments.


text: As one of the elements of our overall risk management program, we focus on the following key areas: • Technical Safeguards: We deploy technical safeguards, including by not limited to firewalls, anti-malware functionality and access controls. • Outside Consultants: We utilize outside consultants, including contractors and other third parties, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advising on potential improvements to our incident prevention, response, and documentation procedures.


text: We have not encountered cybersecurity threats or experienced previously cybersecurity incidents that have materially affected or that we believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Our Board is aware of the critical nature of managing risks associated with cybersecurity threats. Management works with our Board to establish oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence. The Board has delegated to our Audit Committee the primary responsibility for oversight of cybersecurity risks.


text: Management's Role Managing Risk Our CEO, Chief Financial Officer ("CFO"), and Information Technology Manager ("IT Manager") play a primary role in informing the Audit Committee on cybersecurity risks. Our IT Manager has seven years of experience with the Company, which includes management of cybersecurity. These individuals monitor activity and potential risks related to the day-to-day operations of the business, including reviewing results of the work of our outside consultants. They will provide briefings to the Audit Committee on a periodic basis regarding cybersecurity matters, including but not limited to the following: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reporting, if any, and learning from any cybersecurity events; • Risk mitigation efforts and insurance, and • Compliance with regulatory requirements and industry standard.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature (Information Systems and Data). Our Chief Operating Officer and our General Counsel help identify, assess and manage our material risks from cybersecurity threats. Along with our Chief Operating Officer and our General Counsel, a third-party information technology strategy and risk reduction vendor helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal audits, conducting threat assessments for internal and external threats, conducting vulnerability assessments to identify vulnerabilities, use of external intelligence feeds and coordinating with law enforcement as appropriate about certain threats.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response procedures; an incident response policy; a vulnerability management policy; conducting risk assessments; encrypting certain of our data; maintaining network security controls; segmenting certain of our data; maintaining access and physical security controls; asset management, tracking, and disposal protocols; systems monitoring; vendor risk management processes; employee training; maintaining cybersecurity insurance; and retaining a third party information technology strategy and risk reduction vendor.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program; our Chief Operating Officer and General Counsel work with management to prioritize our risk management processes and mitigate cybersecurity threats that are expected to be more likely to lead to a material impact to our business; our Chief Operating Officer and General Counsel evaluate material risks from cybersecurity threats against our overall business objectives and our Chief Operating Officer reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms (including outside legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting services, contract research organizations and contract manufacturing organizations. We have vendor management processes to identify and oversee cybersecurity risks associated with the use of our providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, these processes may include a risk assessment of the vendor, security questionnaire, security assessments, security assessment calls with the vendor's security personnel and imposition of contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems or sensitive data, or those of our third-party CROs or other contractors or consultants, or third parties with whom we work, may fail or suffer security incidents, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive data related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our Chief Operating Officer and our General Counsel. Our Chief Operating Officer has been responsible for the oversight of our cybersecurity since he joined our company in May 2019. He has a B.A. in Computer Science. Our General Counsel has oversight of our legal department, has prior experience serving as inside and outside corporate counsel to technology and cybersecurity companies and a highly regulated cancer diagnostics company.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Operating Officer and our General Counsel. Our Chief Operating Officer and our General Counsel will work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our Chief Operating Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We are increasingly dependent upon information technology systems, infrastructure and data to operate our business. These systems are connected to and/or accessed from the Internet and, as a result, are susceptible to cyber-attacks. In the ordinary course of business, we collect, store and transmit confidential information (including but not limited to intellectual property, proprietary business information and personal information). It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. A material cyber-attack on our systems, or any other third-party partners or vendors and their key operating systems, may interrupt our ability to operate our business, damage our reputation, or result in monetary damages.

companyName: Prelude Therapeutics Inc

ticker: PRLD


text: Prelude has established an Information Security Policy ("IS Policy") in order to establish the high-level direction for properly managing the use, privacy, security, retention, and disposal of Prelude's information and its assets. The IS Policy was prepared using relevant guidance issued and technology standards that are used across various industries. The IS policy applies to all entities who are using Prelude's equipment and resources, including but not limited to: employees, contractors, temporary workers, any third parties with access to the Prelude's resources, and cloud IT providers. Prelude's Head of Information Technology ("IT") also serves as our Information Security Officer and is primarily responsible for implementing and overseeing the IS Policy and identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.


text: Prelude has also established an Incident Response Policy which includes reporting thresholds and follows standardized identification and authentication practices. If an incident is identified, it is documented by Prelude's Head of IT, who in turn, will report the incident to necessary management members.


text: Board Governance and Management Prelude's Information Security Officer provides updates on information technology risks, controls and procedure, including Prelude's plans to mitigate cybersecurity risks and respond to data breaches to Prelude's executive leadership team. Our Information Security Officer has over 20 years of experience in information security and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The Chief Financial Officer and the Chief Legal Officer report to the Chair of the Audit Committee prompt and timely information regarding any significant cybersecurity incident. The significant incident will be reported to the remaining Audit Committee members, as well as ongoing updates regarding any such incident until it has been addressed. Such incidents, as warranted, will be reviewed by the Board of Directors.


text: The Board of Directors has delegated responsibility for cybersecurity risk oversight to the Audit Committee, which is responsible for (i) regularly reviewing with management significant cybersecurity, privacy, and IT risks or exposures, and the Company's policies and processes with respect to risk assessment and risk management of the same; (ii) regularly reviewing with management an assessment of the steps management has taken to monitor and control such risks; and (iii) regularly reporting to the full Board of Directors on such matters. The Chair of the Audit Committee has expertise in risk management which includes IT and cybersecurity.


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Risks related to product development and regulatory process—Our business and operations may suffer in the event that our information technology systems, or those used by our CROs or other contractors or consultants, fail or suffer security breaches."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee receives reports from management on our cybersecurity risks, at a minimum annually and as needed. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, lead by our Executive Director, Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our Executive Director, Information Technology's experience includes 25 years of experience in managing IT environments including assessing the overall risk management program and material risks, as well as building our cybersecurity framework over the past six years.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect information from unauthorized access or attack, as well as secure our network and systems. Such processes include physical, procedural, and technical safeguards, response plans, regular tests on our systems, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including consultants, computer security firms and risk management, peer companies, industry groups, and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them to help protect us from any related vulnerabilities. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber attacks, and other related breaches.

companyName: Inozyme Pharma, Inc.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides periodic updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Vice President of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Vice President of Information Technology has over 25 years of experience working with life science companies and venture capital firms in the information technology field, a certificate from HarvardX (Cybersecurity: Managing Risk), and an active membership in Health-ISAC.


text: We have also established a cross-functional Cybersecurity Steering Committee, led by our Chief Executive Officer serving as the chair and consisting of other executive-level leaders, that is responsible for providing leadership in the protection of information assets and technology. The committee members advise on and prioritize the development of information security initiatives, projects, and policies as advocates for our stakeholders. This committee is also charged with helping to resolve security and compliance risk issues affecting us.


text: In order to help deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with a monthly data protection, cybersecurity, and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. We engage third-party vendors for 24/7 monitoring and comprehensive incident response measures. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We recognize the importance of maintaining cybersecurity measures to safeguard our information systems and to protect the confidentiality and availability of information located on our information systems. Given this importance, we have integrated the consideration of operational risks related to cybersecurity into our enterprise risk management program, which is reviewed and updated annually and the results of this review are presented to the Board.

companyName: RAND CAPITAL CORP

ticker: RAND


text: Given the size and scope of our operations, RCM and our officers use a third-party IT service provider to assist the Corporation in assessing, identifying and managing the material risks from cybersecurity threats to the Corporation and in administering our IT systems. We believe that our third-party IT service provider has sufficient knowledge, experience and capabilities to effectively assist the Corporation on cybersecurity matters.


text: The Corporation's cybersecurity risk management systems processes, which are formalized in the Corporation's cybersecurity risk management policy, include security controls, monitoring systems, tools and related services, and oversight from each of RCM, our officers and our third-party IT service provider in assessing, identifying and managing risks from cybersecurity threats. The Corporation, through our third-party IT service provider, has implemented and expects to continue to implement risk-based controls designed to prevent, detect and respond to information security threats. We rely on these controls to help us protect our information, our information systems, and the information of third parties who entrust us with their sensitive information.


text: The Corporation's cybersecurity risk management policies include physical, administrative and technical safeguards, as well as plans and procedures designed to help the Corporation seek to prevent and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us or RCM. In addition, our cybersecurity risk management program includes periodic identification and testing of our vulnerabilities and cybersecurity awareness training. Finally, our Chief Compliance Officer conducts an annual due diligence review, including as to cybersecurity matters, of those third-party service providers that have possession of the Corporation's material non-public information and reports the results of those assessments to the Board.


text: In the event of a cybersecurity incident impacting us, the Corporation's cybersecurity risk management policy provides processes for responding to such an incident and facilitates coordination among the Corporation's officers and our third-party IT service provider. Depending on the nature of the incident, it may also be reported to the Board, if appropriate.


text: Material Impact of Cybersecurity Risks In the last three fiscal years ended December 31, 2024, we have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors — Risks related to our Business and Structure — We are subject to cybersecurity risks and incidents that may adversely affect our operations, the operations of RCM or the companies in which we invest. A failure in our, or RCM's, cybersecurity systems could impair our ability to conduct business and damage our business relationships, compromise or corrupt our confidential information and ultimately negatively impact business, financial condition and operating results."


text: Oversight of Cybersecurity Risks Our cybersecurity program is managed by the officers of Rand and RCM, and is primarily administered by our experienced third-party IT service provider. The officers of Rand and our third-party IT service provider are in regular communications as a means to discuss and determine actions to be taken by the Corporation with respect to our ongoing cybersecurity risk mitigation efforts.


text: The Board, as a whole, rather than any committee of the Board, has responsibility for oversight and review of cybersecurity matters with respect to the Corporation, including the risks from cybersecurity threats to the Corporation. Our Chief Compliance Officer reports to the Board on a semi-annual basis, or more frequently if necessary, on cybersecurity matters and developments applicable to the Corporation. In addition, the Board also receives periodic reports from the Corporation's third-party IT service provider. These reports, whether from the Chief Compliance Officer or the Corporation's third-party IT service provider, include updates on the Corporation's cybersecurity programs, the external threat environment, and the Corporation's programs and processes to address and mitigate the risks associated with the evolving cybersecurity threat environment. In addition, these reports also include updates on the Corporation's overall IT systems and capabilities and the Corporation's business continuity plan that may need to be activated if a material cybersecurity incident involving the Corporation were to occur. In the event of a material cybersecurity incident, our Chief Compliance Officer would make a report to the Board regarding the event, and the Board would engage in oversight responsibility with respect to the Corporation's response to such event.


text: The Company understands that security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Company is focused on addressing cybersecurity risks on confidentiality, integrity, and the availability of the information the Company collects, transmits and stores by identifying, preventing, and mitigating cybersecurity risks. The Board of Directors, through the Board Risk and Audit Committees, and the Company's Enterprise Risk Management Committee provide direction and oversight of the enterprise-wide risk management program of the Company, which includes the Information Security Program. The Chief Information Officer and the Chief Risk Officer oversee these programs to accomplish the following: • assure the confidentiality, integrity and availability of our information and information systems; • protect against any anticipated threats or hazards to the confidentiality, integrity or availability of such information and information systems; and • protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our clients and the value of the Company.

companyName: CIVISTA BANCSHARES, INC.

ticker: CIVB


text: These programs establish policies (including vendor management), procedures, risk assessments, systems, monitoring, reporting, strategies, and training to effectively manage cybersecurity risks. Specifically, the Company deploys multiple layers of controls, including embedding security into our technology investments, designed to identify, protect, detect, respond to and recover from information security and cybersecurity incidents. The Company also performs simulations and drills to further ensure our readiness and preparedness for potential threats. In addition, the Company employs a nationally recognized firm with information security experts to annually perform audits that extensively test our program and controls, which are reviewed by the Board Audit Committee. These programs and controls align with Federal Financial Institutions Examination Council guidelines and standards.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are present and similar to other financial institutions. The Company, as well as our customers, colleagues, regulators, service providers and other third parties, have seen an increase in information security and cybersecurity risk in recent years. We continue to assess the risks and threats in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity collaboration and capabilities.


text: Cybersecurity is a critical aspect of our operations, and our board of directors and management prioritize safeguarding our digital assets and ensuring the integrity and confidentiality of sensitive information to protect our assets, customers, and stakeholders. Our cybersecurity program is managed by our Global IT Director and overseen by our executive leadership team and board of directors. It encompasses risk management, a management framework, governance, education and training across the organization, SOC2 compliance, and an incident response protocol.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: We employ a proactive risk management strategy to identify, assess, track, and mitigate cyber security risks. Our risk assessment process involves continuous monitoring of our IT infrastructure, external vulnerability assessments, and reviews of our third-party relationships. We prioritize risks based on their potential impact on our operations and implement targeted controls and safeguards to mitigate identified threats.


text: Our Cybersecurity management framework is aligned with the Cybersecurity Framework (CSF) developed by the National Institute of Standards and Technology (NIST) and COBIT 2019. This framework provides a structured approach to managing our policies, standards, and processes, improving our cyber security posture. Additionally, we maintain SOC2 compliance, demonstrating our adherence to industry-recognized security standards and best practices.


text: Our board of directors and executive leadership team, through our Information Security Executive Charter, oversees our risk management program, of which cybersecurity represents an important component. Our Global IT Director is responsible for managing our risk management program, including our cybersecurity strategies and initiatives and the periodic review of our policies, standards, and risks. Our Global IT Director has over 25 years of experience in technology and security.


text: Our board of directors and executive leadership approves cyber security strategies, initiatives, and investments to ensure alignment with business objectives and risk tolerance.


text: In the event of a cyber security incident, we would follow an incident response protocol that includes procedures for incident tracking, escalation, containment, eradication, and recovery. As part of our incident response process, we would adhere to SEC reporting requirements related to cyber security incidents, providing timely and transparent disclosures as necessary.


text: Cybersecurity threats, and their evolving nature, pose a risk to us and our strategy, results of operations, and financial condition in the future. Our risk factors include further detail about the cybersecurity risks we face. To date, cybersecurity threats or incidents have not materially affected us or our operations. Our focus on risk management, governance, compliance, and incident response is intended to mitigate the potential harm posed by evolving cyber threats and challenges.


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: ProFrac Holding Corp.

ticker: ACDC


text: Primary responsibility for our cybersecurity program rests with our Vice President of Information Technology, who has extensive cybersecurity and information technology knowledge and skills gained from over 30 years of work experience at the Company and elsewhere. The Vice President of Information Technology is responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to our Chief Financial Officer. The Vice President of Information Technology at times attends meetings of the Board to report on any material developments and risk management practices.


text: The Vice President of Information Technology meets regularly with members of our information technology team, which includes a security architect whose responsibilities are dedicated solely to cybersecurity matters, a network engineer, and infrastructure director to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our cybersecurity team also works with our Chief Legal Officer to oversee compliance with legal, regulatory and contractual security requirements.


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team. We regularly conduct penetration and vulnerability testing and security audits. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. In addition to our internal cybersecurity capabilities, we also at times engage assessors, auditors, or other third parties to assist with the assessment, identification, and management of cybersecurity risks.


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to our Audit Committee, but retains overall oversight responsibility for cybersecurity matters. The Board and Audit Committee periodically review the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the Board and Audit Committee receive reports from members of our team responsible for overseeing the Company's cybersecurity risk management, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee discusses with such members of our management team our information technology systems and procedures and will report to the Board on any material cybersecurity risks identified. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board and Audit Committee in a timely manner.


text: We have adopted an Information Security Incident Response Policy that applies in the event of a cybersecurity threat or incident (the "ISIRP") to provide a standardized framework for responding to security incidents. The ISIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The ISIRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. As an additional measure to facilitate our timely and comprehensive response to any security incident, we engage a third party vendor on retainer to assist in such incidents.


text: As detailed elsewhere herein, we also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response and reporting plan.

companyName: BOX INC

ticker: BOX


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • teams principally responsible for managing (1) our cybersecurity risk assessment and mitigation processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response and reporting plan that includes procedures for responding to cybersecurity incidents; • a team responsible for compliance with security and regulatory standards including, but not limited to, Service Organization Controls (SOC) reporting, International Organization for Standardization (ISO) frameworks 27001/27017/27018/27701, FedRAMP, and HIPAA; • the use of external service providers, where appropriate, to audit, assess, test or otherwise assist with aspects of our security controls, and to assist with the design and implementation of our cybersecurity policies and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.


text: While we have technology and processes in place to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. We do not believe our business strategy, results of operations or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to our full Board regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our chief information security officer or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Senior leaders of global cybersecurity, governance, risk and compliance teams are responsible for assessing and managing our material risks from cybersecurity threats. They also have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes industry-specific expertise in SaaS technology, regulatory compliance knowledge, previous leadership roles in cybersecurity or related fields, as well as a track record of successfully implementing effective cyber risk mitigation strategies.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engage d by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Gaia recognizes the critical importance of maintaining robust cybersecurity measures to protect our systems, data, and operations and to maintain the trust and confidence of our customers, clients, business partners and employees. Our board of directors is actively involved in oversight of our risk management program, including the management of risks arising from cybersecurity threats. It is our policy to provide regular updates to our shareholders regarding material cybersecurity incidents and the steps taken to address them. We believe that transparency in this area is crucial to maintaining trust and confidence in our operations.

companyName: GAIA, INC

ticker: GAIA


text: We have implemented a comprehensive cybersecurity program designed to identify, assess, and mitigate potential threats and vulnerabilities, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program includes regular risk assessments, network monitoring, penetration testing and incident response protocols. We also provide regular, mandatory training to our personnel regarding cybersecurity threats to educate employees with effective tools and knowledge to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. Our Senior Director of Operations/IT and his team work collaboratively across the Company and with our board of directors and management to maintain our cybersecurity program and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our board of directors and management receive periodic cybersecurity updates from our Senior Director of Operations/IT, which may include recent material cybersecurity incidents and related responses, if any, changes to the risk landscape, and updates or changes to our cybersecurity program. The Company's Senior Director of Operations/IT has served in various roles in information technology and information security at Gaia for over 18 years.


text: Our commitment to cybersecurity extends beyond our internal operations. We work closely with trusted third-party vendors and partners to ensure that they also meet our rigorous security standards. We utilize third-party cloud computing services as part of our global business operations. We also employ the use of third-party content delivery networks (CDN) to help us stream content in high volume to our members over the internet. Problems faced by Gaia or any of our third-party cloud computing or other network providers, involving technological or business-related disruptions, as well as cybersecurity threats, may have an adverse impact on the member experience.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company to date, including our business strategy, results of operations or financial condition.


text: We have certain processes and policies in place to assess, identify and manage material cybersecurity risks. We also periodically monitor and test our information systems for potential vulnerabilities. We use various tools designed to help identify, investigate and resolve cybersecurity incidents, and to help recover from them in a timely manner. These processes, policies and tools comprise our cybersecurity risk program, and are integrated into our overall risk management program.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: We have an Information Technology Policy that sets parameters for the use, privacy, security, retention, and disposal of our information and other assets. We also have an Incident Response Policy which sets forth the steps for assessment, containment, and disclosure of cybersecurity threats. These policies were prepared using relevant guidance and technology standards and are reviewed periodically.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity risk program and have assessed it against the National Institute of Standards and Technology ("NIST") cybersecurity framework. In addition, we consider the internal risk oversight programs of third-party service providers with whom we engage in order to help protect us from any related cybersecurity vulnerabilities.


text: Under our cybersecurity risk program, we provide all of our employees with periodic cybersecurity training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately.


text: Although we are subject to cybersecurity risks, to date, none have materially affected our company, including our business strategy, results of operations, or financial condition. Notwithstanding our cybersecurity risk program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our company. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Our board of directors oversees our risk management process directly and through its committees. The audit committee of our board of directors has the power and responsibility to coordinate our board's oversight over our risk management procedures and to discuss with our management our policies with respect to risk assessment and risk management. Our board of directors has delegated to its audit committee oversight authority of our information security (including cybersecurity) risk management.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our management. Our Senior Director, Human Resources & Infrastructure, who together with our Chief Financial Officer and General Counsel, work in close partnership with our outside information technology and cybersecurity consulting firm, and collectively, comprise the core team members of our Rapid Response Team under our Incident Response Policy. The Rapid Response Team is made up of a broad range of participants with relevant education, skills, and experience to investigate cybersecurity threats and assess the materiality thereof to determine internal reporting to our audit committee and board of directors, as well as external reporting or disclosure requirements. Management provides at least quarterly updates to the audit committee, and in turn management and the audit committee provide periodic updates to our board of directors, regarding ongoing cybersecurity risk assessments and related activities.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. In collaboration with our external vendors specializing in cybersecurity management, we routinely assess material risks from cybersecurity threats, including any potential unauthorized access to our information systems that could result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments of planned material changes in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we consider whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. In consideration of the size and complexity of our business, we devote significant internal and external resources to manage material risks from cybersecurity threats. We also designate specific personnel, including our Senior Director, Information Technology, to manage the risk assessment and mitigation process and to closely coordinate with our General Counsel on applicable regulatory obligations.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through required policy review and trainings at the time of hire and periodically during their employment with us.