Item 1C. Cybersecurity

 

Cybersecurity Risk Management

 

We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

 

In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of a wide array of policies, standards, architecture, and processes. The cyber risk management program falls under the responsibility of our Chief Executive Officer, who in turn, manages our outsourced experts in information technology (“IT”) and cybersecurity. Under the guidance of our Chief Executive Officer, we task reputable third-party IT experts that utilize a wide variety of software to secure the environment. We also utilize a variety of cybersecurity software from reputable vendors in cybersecurity.

 

We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and ensure the effectiveness of our security controls. Our cybersecurity risk management program incorporates several components, including information security program assessments, continuous monitoring of critical risks from cybersecurity threats using automated tools, restoration testing, periodic threat testing, and documented standards, policies, and procedures. We deploy a wide range of security tools across the environment, require multifactor authentication across all critical systems, and implement access control policies to further limit protect the data within the systems.

 

We periodically engage third parties to conduct risk assessments, including periodic penetration testing and other system vulnerability analyses. As a result of these assessments and testing, we have not identified any material cybersecurity risks. We also maintain documentation of our system hardening progress and plans. Additionally, our program requires cybersecurity training, which includes social engineering and phishing training, on a quarterly basis, for all employees.

 

Governance

 

Our Board of Directors (the “Board”) is responsible for the oversight of cybersecurity risk management. The Chief Executive Officer reports to our Board. The Chief Executive Officer provides updates to the Board on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on a regular basis. The Chief Executive Officer also notifies the Board of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.