Item 1C. CYBERSECURITY

 

We have developed and implemented a cybersecurity risk management program that is designed to protect the confidentiality, integrity, and availability of the Company’s data and systems. Our cybersecurity risk management program includes a cybersecurity incident response plan.

 

Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

 

Our cybersecurity risk management program includes:

 

	●	A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment;
	●	A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
	●	The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;
	●	Cybersecurity awareness training of our employees, incident response personnel, and senior management; and
	●	A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

 

Additionally, the Company assesses and manages cybersecurity threats associated with its third-party service providers’ information technology systems that could compromise the Company’s information security or data. Identified cybersecurity threats are communicated to management for review, response and mitigation as appropriate.

 

As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A: Risk Factors— Risks Relating to our Business: We are susceptible to cybersecurity breaches and cyber-related fraud.

 

 

Cybersecurity: Governance

 

Our Board of Directors considers cybersecurity risk within the Board’s risk oversight function. The Board of Directors has charged management with the responsibility for oversight of cybersecurity risks and incidents and any other risks and incidents relevant to the Company’s computerized information system controls and security. The Board and its Audit Committee oversee management’s implementation of our cybersecurity risk management program.

 

Implementation and maintenance of our IT systems has been outsourced to a third-party contractor: Tyler Melton Technologies, LLC (“TMT”), which has over ten years of experience in support of cybersecurity for business enterprises. Supervision of the services provided by TMT for the Company is the responsibility of our Corporate Controller, who is charged with the role of assessing and managing our material risks from cybersecurity threats. Our Corporate Controller reviews the efficacy of our cybersecurity program from time to time as circumstances make it appropriate and annually in connection with the annual audit of the Company’s financial statements. Our Corporate Controller renders to the auditor a written report regarding IT general controls, including cybersecurity systems, risk assessment and monitoring practices. The auditor reviews the report in connection with its assessment of the Company’s internal controls over financial reporting, and advises Company management if the report reveals flaws in the Company’s internal controls. Copies of the Corporate Controller’s report are also given to the CEO/CFO and made available to members of the Board of Directors. Copies of the auditor’s report are delivered to the members of the Board of Directors, which reviews and is responsible to cause a remediation of any material inadequacies in the controls environment.

 

Our Corporate Controller reports to our CEO/CFO on matters of cybersecurity, and together they carry responsibility for our overall cybersecurity risk management program. Our CEO/CFO provides prompt reports to the Board regarding cybersecurity risks and incidents as they are revealed, as well as periodic reports, as appropriate, regarding the Company’s cybersecurity program.