ITEM 1C. CYBERSECURITY

 

Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer and Chief Financial Officer, are actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company’s overall approach to enterprise risk management (“ERM”). Our cybersecurity processes and practices are fully integrated into the Company’s ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. In addition, we regularly review cybersecurity trends and, partially as a result of our prior cybersecurity exposure, have moved some of our internal servers to off-site locations.

 

Risk Management and Strategy

 

As one of the critical elements of our overall ERM approach, our cybersecurity efforts are focused on the following key areas:

 

●

Governance: Management oversees cybersecurity risk mitigation and reports to the board of directors any cybersecurity incidents.

 

●

Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

 

●

Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

 

Third parties also play a role in our cybersecurity. We engage third-party service providers to conduct evaluations of our security controls, independent audits or consulting on best practices to address new challenges.

 

While we have experienced cybersecurity threats in the past in the normal course of business and expect to continue to experience such threats from time to time, to date, none have had a material adverse effect on our business, financial condition, results of operations or cash flows. Even with the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.