Item 1C. Cybersecurity

 

In the ordinary course of business, we receive, process, use, and store digitally large amounts of data, including confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to us and our business operations. To this end, we have implemented policies designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. While we have taken measures designed to protect the security of the confidential and personal information under our control, we cannot provide absolute assurance that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats.

 

Our cybersecurity program is managed by our Chief Technology Officer. Most of the information generated and collected by us is stored and maintained by third-party vendors and service providers, who have demonstrated their own cybersecurity protocols which our management believes to be adequate for protecting our digital files in their possession. Our CTO is responsible for assessing and managing cybersecurity risks. Our CTO has cybersecurity expertise. We have no formal cybersecurity policies and processes in place, however, the Board and management believe cybersecurity represents an important component of our overall approach to risk management and oversight.

 

 

 

 

 

We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. We intend to provide our Board of Directors with periodic updates on cybersecurity and information technology matters and related risk exposures from management. Most information is stored directly to Amazon Web Services platforms, which provide market-leading data security for their centralized servers. Our company follows best practices for security, indemnity and compliance. All connections in and out of our remote services are done over secure connections, including https and Secure Shell (SSH) protocols. On occasion, limited amounts of information such as names and emails are exported from our systems solely for the purposes of accounting and filings and is not shared outside of our company and its contracted accounting consultants, which are under confidentiality agreements.

 

Cybersecurity threats have not materially affected our company, including its business strategy, results of operations or financial condition. Our company is not aware of any material security breach to date. Accordingly, our company has not incurred any expenses over the last two years relating to information security breaches. The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information and systems, or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations. There can be no assurance that our third-party vendors’ and service providers’ cybersecurity risk management processes, including their policies, controls or procedures, will be effective in protecting our systems and information.