What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-27 compared with 2025-03-28 · 33 added, 22 removed, 60 unchanged (48% of the section changed)

13 unchanged sentences

of an inventory of information systems (“Information Systems”) employed by the Sponsor of the Trust either directly or through

Information Systems include electronic and physical systems used to store, process or transmit information either directly or

through a service provider.

Information Systems include electronic and physical systems used to store, process or transmit information either directly

or through a service provider.

This includes all methods of data processing, transmission, and retention, both electronic and physical.

Information Systems used by on behalf of the Trust must, at a minimum, adequately address security elements consistent with applicable

state and local regulatory requirements and best practices pertaining to:

Electronic Information Systems used by on behalf of the Trust must, at a minimum, adequately address security elements consistent with

applicable state and local regulatory requirements and best practices pertaining to:

Data Storage,

5 unchanged sentences

The CISO is responsible for classifying information, identifying risks, and identifying risk mitigation strategies.

CISO is also responsible for evaluating the adequacy of risk mitigation strategies prior to deploying any Information System.

The CISO is also responsible for evaluating the adequacy of risk mitigation strategies prior to deploying any Information System.

hosted applications (those not installed on the Sponsor’s local network and servers) are reviewed by the CISO at least annually

6 unchanged sentences

Risk Mitigation

The CISO will identify processes or controls to

mitigate identified risks to the security or integrity of each Information System.

The CISO will identify processes or controls

to mitigate identified risks to the security or integrity of each Information System.

The computer system security requirements set forth

13 unchanged sentences

The CISO must evaluate the risk mitigation strategies for ongoing adequacy.

The evaluation must be documented in

a form prescribed by the CISO.

The evaluation must be documented

in a form prescribed by the CISO.

If the CISO concludes that risk mitigation strategies are inadequate for an Information System containing

confidential or internal information, action will be taken to either correct the inadequacy in a timely manner or discontinue use of the

Information System.

confidential or internal information, action will be taken to either correct the inadequacy in a timely manner or discontinue use of

the Information System.

Cybersecurity Procedures

1 unchanged sentence

the cybersecurity policy applicable to the Trust, which include the following:

The Sponsor maintains system access rights and controls for the Trust including:

restricting Supervised Persons’ (a “Supervised Person” is each employee, officer, member, and other persons who are subject to the Sponsor’s supervision and control) network resources access to the systems which are necessary for their business functions,

The Sponsor maintains system access rights and controls for the Trust

restricting Supervised Persons’ (a “Supervised Person”

is each employee, officer, member, and other persons who are subject to the Sponsor’s supervision and control) network resources

access to the systems which are necessary for their business functions,

use of passwords,

1 unchanged sentence

secure remote access protocols;

The Sponsor maintains its systems carrying Trust data with appropriate updates and virus protections;

The Sponsor promptly eliminates access to all networks, devices, and resources as part of its HR procedures in the event a Supervised Person resigns or is terminated.

Such Supervised Person is required to immediately return all Sponsor-related equipment and information to the CISO;

The Sponsor has adopted procedures governing the use of mobile devices for the business purposes affecting the Trust;

The Sponsor prohibits Supervised Persons from installing software on company owned equipment without first obtaining approval from the CISO or other designated person(s);

The CISO or other designated person(s) conducts periodic monitoring of the networks affecting the Trust to detect potential cybersecurity events;

The CISO or other designated person(s) conducts periodic monitoring of the networks affecting the Trust to detect unauthorized data transfers;

Security procedures to protect information that is electronically stored or transmitted include authentication protocols;

The Sponsor maintains its systems carrying Trust data with appropriate

updates and virus protections;

The Sponsor promptly eliminates access to all networks, devices, and

resources as part of its HR procedures in the event a Supervised Person resigns or is terminated.

Such Supervised Person is required

to immediately return all Sponsor-related equipment and information to the CISO;

The Sponsor has adopted procedures governing the use of mobile devices

for the business purposes affecting the Trust;

The Sponsor prohibits Supervised Persons from installing software on

company owned equipment without first obtaining approval from the CISO or other designated person(s);

The CISO or other designated person(s) conducts periodic monitoring

of the networks affecting the Trust to detect potential cybersecurity events;

The CISO or other designated person(s) conducts periodic monitoring

of the networks affecting the Trust to detect unauthorized data transfers;

Security procedures to protect information that is electronically stored

or transmitted include authentication protocols;

secure access control measures, and encryption of all transmitted files;

All suspicious activity involving the Information Systems affecting the Trust recognized or uncovered by personnel should be promptly reported to his or her supervisor and/or the CISO;

All suspicious activity involving the Information Systems affecting

the Trust recognized or uncovered by personnel should be promptly reported to his or her supervisor and/or the CISO;

● A Supervised Person must immediately notify his or her supervisor and/or the CISO to report a lost or stolen laptop, mobile device, and/or flash drive.

6 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments