Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None
Item 1C. Cybersecurity
We have implemented structured processes to evaluate, identify, and mitigate significant cybersecurity risks that may affect the confidentiality, integrity, or availability of its information systems and data. These processes include implementing controls and technologies designed to prevent, detect, and mitigate data loss, theft, misuse, unauthorized access, or other security incidents . Our information security program safeguards confidential, proprietary, business, and personal information and incorporates measures to mitigate the impact of security incidents involving third-party vendors or customers .
We actively oversee cybersecurity risks related to third-party technologies , including encryption, authentication, employee email, and content delivery. Our risk management strategy includes security assessments, penetration testing, vulnerability management, and audits. All employees with access to information systems are required to review and and comply with the Angel Cybersecurity Policy.
Our Security Chapter is responsible for overseeing cybersecurity initiatives and collaborates with teams across Angel Studios to ensure compliance with industry best practices. The Security Chapter is led by an industry expert with more than 18 years of professional cybersecurity experience. We also engage independent third-party assessors when necessary to evaluate and enhance our cybersecurity posture. Cybersecurity risks and associated controls are reviewed regularly as part of our enterprise risk management framework .
Risk Management & Strategy. We maintain an enterprise information security program that uses industry frameworks to identify, assess, and manage cybersecurity risks across our cloud infrastructure, content delivery platforms, payment processing, and corporate systems. Program elements include security governance, access control, encryption, vulnerability management, penetration testing, incident response, employee training, and third‑party risk management. For critical vendors (e.g., cloud, CDN, payment processors), we perform due diligence, impose contractual security requirements, and conduct periodic assessments.
Governance. The Board of Directors, through the Audit Committee, oversees cybersecurity risk at least quarterly. Management provides updates on threat trends, program maturity, third‑party risk, incidents, and remediation activities.
Incidents & Effects. To date, we have not experienced a material cybersecurity incident. We receive and investigate attempted attacks and take remediation steps as appropriate. Based on our assessments, cybersecurity risks have not materially affected our operations, strategy, or financial results to date; however, future incidents (including at third-party providers) could have a material effect. We also acknowledge that generative AI could intensify these cybersecurity risks.