Company: FCRX
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0000950170-25-023153
Chunk: 494

Company: Crescent Capital BDC, Inc.
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 494
---
The Company is externally managed by the Adviser and has no employees or internal information systems. Thus, the Company relies on the Adviser and the Administrator, their parent company, Crescent, as well as the custodian and other service providers to protect the Company’s information from cybersecurity threats. The Company’s Chief Compliance Officer (the “CCO”), together with Crescent’s  Head of Information Technology,  oversee the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. Crescent uses various security tools and procedures that help the Company identify, escalate, investigate, resolve and recover from cybersecurity incidents in a timely manner.  

The CCO and Crescent also review key Company service providers’ compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers’ use of information systems which have the potential to subject the Company to information technology vulnerabilities and receive reports from the Company’s service providers regarding any cybersecurity threats and incidents. As part of the oversight of the Company’s key service providers, Crescent engages a third-party consultant to conduct a cybersecurity assessment and preparedness analysis on such service providers on an annual basis. The CCO and the Head of Information Technology provide regular reports to the Board of Directors regarding significant risks to the Company, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board of Directors regarding material cybersecurity matters as they arise. The Company has also adopted policies and procedures designed to ensure the timely disclosure of any material cybersecurity incidents.    

Crescent follows National Institute of Standards and Technology standards for cybersecurity risk management and has put policies, controls and multiple layers of security in place to safeguard its systems and data, including those of the Company.  In particular, Crescent deploys specialized security technology and operational controls including, but not limited to firewalls, anti-virus systems, multi-factor authentication, restricted access, and electronic surveillance/monitoring. Crescent conducts regular testing to assess information technology vulnerabilities and employee cybersecurity awareness, utilizes third-party technology solutions for real-time vulnerability management, and engages third-party consultants to conduct cybersecurity assessment and preparedness analyses periodically. Crescent also requires all employees, including those of the Adviser and the Administrator, to complete comprehensive cybersecurity training at least annually.   

Crescent’s Head of Information Technology has over 30 years of experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Our CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures