Item 1C.

CYBERSECURITY

 

Risk management and strategy

 

We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, customer data, and the personal information of our employees (collectively, “Information Systems and Data”).

 

Our IT Manager, along with the information security and technical consultants hired by us, help identify, assess, and manage our cybersecurity threats and risks. They work to identify and assess risks from cybersecurity threats by monitoring and evaluating the threat environment using various methods including manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry’s risk profile, conducting audits and threat assessments, conducting vulnerability assessments, and external threat intelligence.

 

Depending on the environment, system, and data, we implement and maintain certain technical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response procedures, vulnerability management process, disaster recovery/business continuity plans, encryption, network security controls, user access controls including multifactor authentication and role-based access, data segregation, asset management, systems monitoring, vendor risk management program, employee training, penetration testing and cybersecurity insurance.

 

Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes, including by prioritizing our risk management processes and mitigating cybersecurity threats that are more likely to lead to a material impact to our business.

 

We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms, cybersecurity consultants, managed cybersecurity service providers, penetration testing firms, and forensics investigators as needed.

 

We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and various supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers which includes, depending on the vendor, nature of the services provided, and sensitivity of the Information Systems and Data at issue: different levels of assessment designed to help identify cybersecurity risks associated with the vendor, security questionnaires, review of security assessments, and imposition of contractual obligations related to cybersecurity.

 

We are subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition, and liquidity, as further discussed in Item 1A “Risk Factors” under the headings “Risks Related to Our Business.” We are not aware of having experienced any cybersecurity threats or incidents to date that have materially affected or are reasonably likely to materially affect our business, results of operation or financial condition.

 

Governance

 

Our board of directors oversees the Company’s cybersecurity risk management as part of its general oversight function. The Audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

 

Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Manager, who has twenty-five years of experience.

 

 

Back SEC Filing Thank you for subscribing