Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
Not applicable.
Item 1C. Cybersecurity
We recognize the critical importance of maintaining the safety and security of our technology systems and data. Accordingly, the Company takes a comprehensive approach to identifying and managing cybersecurity risks that involves the Company’s information technology security team, senior management, Audit Committee and Board of Directors. Our
45
Tab l e of Contents
cybersecurity risk management function is a component of our overall approach to risk management, which is implemented and overseen by our Enterprise Risk Management Committee.
Cybersecurity Risk Management and Strategy
Our cybersecurity risk management function is a component of our overall approach to risk management, which is implemented and overseen by our Enterprise Risk Management Committee. The Company’s cybersecurity risk management policies and procedures, which are based upon the CIS v8 Framework, portions of the NIST Framework, ISO 27001, are designed to support the Company in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents.
These policies and procedures are reviewed and updated in connection with risk assessments, which identify reasonable and foreseeable risks. Third-party and internal assessments are conducted annually to measure the effectiveness of safeguards, operating effectiveness of security measures, and to inform future considerations of the program. The Company implements security policies throughout its operations and utilizes the enterprise risk management process designed to quantify, report, and plan to remediate identified cybersecurity risks.
Our cybersecurity risk management policies and procedures include:
• Third-party and internal risk assessments designed to help identify material cybersecurity risks to critical systems, data, services and general information technology environment.
• An annual review of third-party service providers critical to the operation of the Company.
• A third-party risk management framework designed to identify, monitor, remediate and respond to third-party cybersecurity risks and incidents.
• Cybersecurity awareness training program for all employees and contractors to inform and educate, with built in quantitative testing for effectiveness.
• A security team staffed with full-time employees and supplemented by a third party managed security service provider responsible for monitoring, investigating, and responding to potential incidents, threats, or breaches.
Although we have designed our cybersecurity risk management policies and procedures described above to mitigate cybersecurity risks, there can be no assurance that such policies and procedures will be fully implemented, complied with, or effective in protecting our systems and information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
Cybersecurity Governance
The Company’s information technology security team, led by our Chief Information Officer and Chief Information Security Officer (“CISO”), is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the Company’s senior management. The Company’s CISO, who has over 20 years’ experience in information technology, holds high-level licenses and certifications relating to information security, including the ISC2 CISSP.
The Company’s CISO regularly briefs the Company’s senior management, including the General Counsel and Chief Compliance Officer who serves as Chair of the Enterprise Risk Management Committee, on cybersecurity trends and regulatory updates, technology risks and implications for the Company’s business strategy. The Company’s CISO and senior management regularly update the Audit Committee on such trends, as well as the Company’s information security and control effectiveness. In addition to regular reporting, the Company has procedures by which cybersecurity incidents are reported in a timely manner to senior management, including the CEO and other members of the executive team, who collectively determine if a specific cybersecurity incident warrants escalation to the Audit Committee and the Board of Directors. The Board of Directors oversees the Company’s cybersecurity policies and procedures through the Audit Committee and also receives periodic briefings from senior management as well.
Cybersecurity Risks and Threats
Although we have designed our cybersecurity governance and policies and procedures described above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future.
46
Tab l e of Contents