XML 56 R19.htm IDEA: XBRL DOCUMENT v3.26.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] Risk Management, Strategy and Procedures
The Fund’s day‐to‐day operations are managed by the General Partner subject to certain oversight rights held by the Board.
The Investment Advisor supports the Fund in managing its Portfolio Companies consistent with the Fund’s investment
objective. The executive officers are senior Carlyle professionals and our General Partner and Investment Advisor are both
subsidiaries of Carlyle. As such, we are reliant on Carlyle for assessing, identifying and managing material risks to our business
from cybersecurity threats.
Carlyle regularly assesses risks from cybersecurity threats, monitors our information systems for potential vulnerabilities,
and tests those systems pursuant to its cybersecurity policies, standards, processes, and practices, which are integrated into its
overall risk management system. To protect our information systems from cybersecurity threats, Carlyle uses various security
tools that help identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented
by Carlyle’s Global Technology & Solutions (“GTS”) team in partnership with other stakeholders, and are essential for our
operations. Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk
management processes that log events and help protect our data. In addition, our business continuity plans are designed to allow
critical business functions to continue in the event of an emergency. The GTS team works closely with Carlyle’s business
segment teams, including our General Partner and Investment Advisor, to maintain operational resilience through business
continuity planning and annual information technology disaster recovery and incident response plan testing. These efforts are
underpinned by the implementation of security best practices, where possible, such as:
Multi-factor authentication for remote access, privileged access management for system administrators, application
whitelisting, laptop encryption, mobile device management software, and advanced malware defenses on endpoints;
Incident preparedness and response planning and risk mitigation;
Independent and continuous security testing, assessment and third-party risk management;
Regular security awareness training, including phishing simulations;
Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and
USB storage devices;
Device and system access management policies and procedures that restrict access upon employee or contractor
separation from the company; and
Attestations by Carlyle personnel to abide by firm policies, such as Carlyle’s acceptable use policy, upon hire and
annually.
In addition, Carlyle partners with third parties to assess the effectiveness of its cybersecurity program, which includes the
Fund. Third party assessments will include audits and assessments performed under the direction of Carlyle’s internal audit
team, which co-sources with third-party cybersecurity experts in conducting its reviews. GTS also administers Carlyle’s cyber
third-party risk management program, which assesses external service providers before onboarding and provides ongoing
monitoring in accordance with certain risk-based cybersecurity criteria.
To our knowledge, cybersecurity threats, including as a result of any previous detected or undetected cybersecurity
incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, however,
we may learn new facts about these detected or undetected incidents and these facts may lead us to change this materiality
assessment. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures
and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given
that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether
risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of
operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see
Part I, Item 1A. Risk Factors—Cybersecurity incidents or data privacy breaches could have numerous material adverse
effects, including on the operations, liquidity, and financial condition of the Fund.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Carlyle regularly assesses risks from cybersecurity threats, monitors our information systems for potential vulnerabilities,
and tests those systems pursuant to its cybersecurity policies, standards, processes, and practices, which are integrated into its
overall risk management system. To protect our information systems from cybersecurity threats, Carlyle uses various security
tools that help identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented
by Carlyle’s Global Technology & Solutions (“GTS”) team in partnership with other stakeholders, and are essential for our
operations. Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk
management processes that log events and help protect our data. In addition, our business continuity plans are designed to allow
critical business functions to continue in the event of an emergency. The GTS team works closely with Carlyle’s business
segment teams, including our General Partner and Investment Advisor, to maintain operational resilience through business
continuity planning and annual information technology disaster recovery and incident response plan testing. These efforts are
underpinned by the implementation of security best practices, where possible, such as:
Multi-factor authentication for remote access, privileged access management for system administrators, application
whitelisting, laptop encryption, mobile device management software, and advanced malware defenses on endpoints;
Incident preparedness and response planning and risk mitigation;
Independent and continuous security testing, assessment and third-party risk management;
Regular security awareness training, including phishing simulations;
Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and
USB storage devices;
Device and system access management policies and procedures that restrict access upon employee or contractor
separation from the company; and
Attestations by Carlyle personnel to abide by firm policies, such as Carlyle’s acceptable use policy, upon hire and
annually.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] The Board and the Audit Committee are responsible for understanding the primary risks to our business, including from
cybersecurity threats. Carlyle’s Chief Information Security Officer (“CISO”) leads our cybersecurity program, chairs Carlyle’s
Information Security Committee (“ISC”), and provides cybersecurity status reporting to Carlyle’s Audit Committee at least
annually. The ISC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle’s strategic priorities.
Carlyle takes a risk-based approach to cybersecurity and has implemented cybersecurity policies, standards, processes, and
practices throughout its operations (including the operations of the Fund) that are designed to address cybersecurity threats,
events, and incidents. In particular, Carlyle’s cybersecurity program supports security governance, security awareness and
training, security engineering and architecture, security risk management, vulnerability management, security monitoring, and
incident response capabilities. In addition, Carlyle’s incident response plan contains escalation and reporting protocols,
including reporting to its disclosure committee, which includes members of the disclosure committee of the General Partner, to
consider materiality of cybersecurity incidents. Policies and procedures are in place to assist the disclosure committee with
these materiality assessments and any resulting reporting requirements.
Carlyle’s CISO, in coordination with senior executives of our General Partner and Investment Advisor, is responsible for
leading the assessment and management of cybersecurity risks. The current Carlyle CISO has over 20 years of experience in
information security and that includes key roles managing cybersecurity risk in both government and the private sector.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board and the Audit Committee are responsible for understanding the primary risks to our business, including from
cybersecurity threats. Carlyle’s Chief Information Security Officer (“CISO”) leads our cybersecurity program, chairs Carlyle’s
Information Security Committee (“ISC”), and provides cybersecurity status reporting to Carlyle’s Audit Committee at least
annually. The ISC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle’s strategic priorities.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Carlyle’s Chief Information Security Officer (“CISO”) leads our cybersecurity program, chairs Carlyle’s
Information Security Committee (“ISC”), and provides cybersecurity status reporting to Carlyle’s Audit Committee at least
annually. The ISC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle’s strategic priorities.
Cybersecurity Risk Role of Management [Text Block] The Board and the Audit Committee are responsible for understanding the primary risks to our business, including from
cybersecurity threats. Carlyle’s Chief Information Security Officer (“CISO”) leads our cybersecurity program, chairs Carlyle’s
Information Security Committee (“ISC”), and provides cybersecurity status reporting to Carlyle’s Audit Committee at least
annually. The ISC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle’s strategic priorities.
Carlyle takes a risk-based approach to cybersecurity and has implemented cybersecurity policies, standards, processes, and
practices throughout its operations (including the operations of the Fund) that are designed to address cybersecurity threats,
events, and incidents. In particular, Carlyle’s cybersecurity program supports security governance, security awareness and
training, security engineering and architecture, security risk management, vulnerability management, security monitoring, and
incident response capabilities. In addition, Carlyle’s incident response plan contains escalation and reporting protocols,
including reporting to its disclosure committee, which includes members of the disclosure committee of the General Partner, to
consider materiality of cybersecurity incidents. Policies and procedures are in place to assist the disclosure committee with
these materiality assessments and any resulting reporting requirements.
Carlyle’s CISO, in coordination with senior executives of our General Partner and Investment Advisor, is responsible for
leading the assessment and management of cybersecurity risks. The current Carlyle CISO has over 20 years of experience in
information security and that includes key roles managing cybersecurity risk in both government and the private sector.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Carlyle’s Chief Information Security Officer (“CISO”) leads our cybersecurity program, chairs Carlyle’s
Information Security Committee (“ISC”), and provides cybersecurity status reporting to Carlyle’s Audit Committee at least
annually. The ISC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle’s strategic priorities.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The current Carlyle CISO has over 20 years of experience in information security and that includes key roles managing cybersecurity risk in both government and the private sector.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Carlyle takes a risk-based approach to cybersecurity and has implemented cybersecurity policies, standards, processes, and
practices throughout its operations (including the operations of the Fund) that are designed to address cybersecurity threats,
events, and incidents. In particular, Carlyle’s cybersecurity program supports security governance, security awareness and
training, security engineering and architecture, security risk management, vulnerability management, security monitoring, and
incident response capabilities. In addition, Carlyle’s incident response plan contains escalation and reporting protocols,
including reporting to its disclosure committee, which includes members of the disclosure committee of the General Partner, to
consider materiality of cybersecurity incidents. Policies and procedures are in place to assist the disclosure committee with
these materiality assessments and any resulting reporting requirements.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true