Company: GAINI
Filing Date: 2025-05-13
Form Type: 10-K
Source: 0001321741-25-000010
Chunk: 166

Company: GLADSTONE INVESTMENT CORPORATION\DE
Filing Date: 2025-05-13
Form: 10-K
Item: Item 1C
Chunk 166
---
ITEM 1C.    CYBERSECURITY

Risk Management and Strategy

Our Adviser and Administrator have implemented ongoing processes that are designed to continually identify, assess, manage, monitor and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our Adviser’s and Administrator’s resource management, information technology ("IT") and compliance departments work in conjunction with an independent third-party information technology service provider (“ISP”) engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists our Adviser and Administrator in monitoring our cyber and information security programs. The ISP proposes recommendations for improvements to our Adviser’s Head of Resource Management, Director of IT and Chief Compliance Officer ("CCO"), which then are considered by other relevant officers of our Adviser and Administrator before implementation.In addition, regular ongoing cybersecurity threat risk assessments, which also cover third-party business applications, are performed throughout the year and reported to our officers and Board of Directors by our CCO no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately.Our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, the Director of IT, Head of Resource Management and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: •implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards;•anti-malware, antivirus and threat detection software;•ransomware containment and isolation software;•enhanced password requirements and multifactor authentication requirements;•endpoint encryption;•intrusion detection and response system conduct file integrity monitoring;•email archiving, firewalls, and quarantine capabilities;•mobile device management of business applications;•frequent systems backups with recovery capabilities; and•regular vulnerability scans and penetration testing.

42

Table of Contents

Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to