Risk Management and Strategy

We identify and address cybersecurity threats and risks related to our business using a multi-faceted approach that includes assessments by our management, external IT provider, and third-party service providers. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes. Our management performs an annual review of third-party service providers’ Service Organization Controls (“SOC”) reports to verify appropriate controls are in place.

In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our ongoing efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Please refer to the risk factor titled “We are increasingly dependent on information technology systems, infrastructure and data. Cybersecurity breaches could expose us to liability, damage our reputation, compromise our confidential information or otherwise adversely affect our business.” in “Risk Factors” in Part I, Item 1A of this Form 10-K for more information on the risks posed to us by cybersecurity threats.

Cybersecurity Governance

Cybersecurity is an important part of our risk management processes and is an area of focus for our Board and management. Our Board, as a whole, has oversight responsibility for our strategic and operational risks, and ensures that appropriate risk mitigation strategies are implemented by management. Our Board periodically reviews and discusses our risk assessment and risk management practices, including cybersecurity risks, with members of management. In addition, our management is responsible for day-to-day assessment and management of cybersecurity risks.