Anterix Inc. 10-K

ITEM 1B. UNRESOLVED STAFF COMMENTS None. ITEM 1C. CYBERSECURITY Risk Management and Strategy We have implemented and we maintain a cybersecurity program that includes a well-defined set of security controls and measures designed to identify, assess, and manage material cybersecurity risks. The cybersecurity program is a part of our broader enterprise risk management program which includes risk assessment, third party risk management, risk mitigation strategy and a clearly defined incident response methodology. The program is led by our executive officers, with support from a working group of senior management with functional and operational expertise. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Director of Information Technology (“IT”), who reports directly to our Chief Financial Officer. Our Director of IT has more than 20 years of experience working with enterprises to protect their systems from cybersecurity risks and to address other areas of risk management. We also engage other consultants and third parties in connection with our risk assessment and mitigation processes. These service providers assist with the design and implementation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain Page 30 Table of Contents reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Governance Oversight for this program is provided by the Audit Committee of the Board. Each quarter our executive officers review matters, including any cybersecurity matters, that may present material risks to our strategy, mission or objectives, and where appropriate, engage third parties to conduct assessments of the risks and gaps that require attention. Risk events are classified based on the evaluated likelihood of the risk materializing and its potential impact on the enterprise, and for each material risk a definitive risk mitigation strategy is developed, executed, and shared with the Audit Committee and the Board by our Chief Legal Officer and Corporate Secretary, working closely with our Chief Financial Officer and Director of IT , at least quarterly to ensure appropriate monitoring and management of the relevant risks. Cybersecurity Threat Disclosure To date, based upon all evaluations and assessments, including third party evaluations, we have no cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, operations or financial condition .