Creative Media (CMCT) Risk Analysis

CIM Group’s internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the “Committee”) for evaluation. The Committee consists of CIM Group’s Chief Technology Officer (the “CTO”), CIM Group’s Chief Compliance Officer (the “CCO”) and representatives from CIM Group’s operations, compliance and accounting departments. The Committee is responsible for CIM Group’s cybersecurity policy and overseeing the activities of CIM Group’s cybersecurity practices, including assessing CIM Group’s risks and controls. The Committee is chaired by the CTO and has more than 30 years of experience in the fields of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee has relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and have multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+. CIM Group’s internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the “Committee”) for evaluation. The Committee consists of CIM Group’s Chief Technology Officer (the “CTO”), CIM Group’s Chief Compliance Officer (the “CCO”) and representatives from CIM Group’s operations, compliance and accounting departments. The Committee is responsible for CIM Group’s cybersecurity policy and overseeing the activities of CIM Group’s cybersecurity practices, including assessing CIM Group’s risks and controls. The Committee is chaired by the CTO and has more than 30 years of experience in the fields of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee has relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and have multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+. The Committee has established a Cybersecurity Subcommittee (the “Subcommittee”). The Subcommittee consists of, among other individuals, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC’s cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC’s cybersecurity rules adopted in 2023), including us, in complying with such cybersecurity rules. The Committee has established a Cybersecurity Subcommittee (the “Subcommittee”). The Subcommittee consists of, among other individuals, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC’s cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC’s cybersecurity rules adopted in 2023), including us, in complying with such cybersecurity rules. The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the CIM Group’s IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee’s and the Subcommittee’s respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the CIM Group’s IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee’s and the Subcommittee’s respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels,