Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
Management and Board Oversight
In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems are important to our operations and business strategy. The Audit Committee , which is composed solely of independent directors, has been designated by our Board to review and discuss with management the Company’s risk assessment and risk management policies, including the steps that management has taken to monitor and control related cybersecurity risks and exposures. Management updates the Audit Committee and the Board as necessary about significant cybersecurity occurrences and measures the Company is taking to prevent the same.
Risk Management and Strategy
We rely on our subsidiary-level information technology professionals to continuously monitor and update our IT networks and infrastructure. Their role is to prevent, detect, address, and mitigate risks related to unauthorized access, misuse,
65
Table of Contents
malware, and other security threats. To safeguard our data and business processes, as well as those of our subsidiaries, we invest in industry-standard security technologies to defend against cyber risks.
To further strengthen our cybersecurity efforts, with our subsidiary’s assistance, we are establishing an “IT Steering Committee” composed of IT professionals from our subsidiary. This committee will meet quarterly to discuss cybersecurity threats, emerging attack methods, and best practices.
In fiscal year 2024, our crypto-processing subsidiary engaged an external consultant to conduct a cybersecurity risk assessment of our business operations. This assessment examined both internal and external threats to our systems and data handling processes, providing a structured framework for evaluating, prioritizing, and enhancing our cybersecurity initiatives. On a going-forward basis, in collaboration with our Audit Committee, management will determine and implement appropriate measures based on these findings.
As part of our cybersecurity risk management program, we are working with our crypto-processing subsidiary to develop a cyber training curriculum for our employees. The training may cover topics such as phishing awareness, cybersecurity best practices, and e-mail security.
Despite our commitment to cybersecurity, no system can fully eliminate technology risks. As of now, we are unaware of any cybersecurity incidents that have had, or are reasonably likely to have, a material impact on our business or operations. However, the increasing volume and sophistication of cyberattacks—including data breaches, ransomware, and similar threats—pose ongoing risks. Incidents that occur could result in reputational, competitive, operational, or financial harm, as well as regulatory consequences. For a more detailed discussion of how cybersecurity threats may affect our business strategy, operations, or financial condition, see Item 1A, “Risk Factors,” which is incorporated by reference into Item 1C.