Item 1B. Unresolved Staff Comments
Item
1B. Unresolved Staff Comments
Not
applicable.
Item
1C. Cybersecurity
Risk
Management and Strategy
We
have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability
of our critical systems and information. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity
Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather
that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Key
elements of our cybersecurity risk management program include:
● risk
assessments designed to help identify material cybersecurity risks to our critical systems,
information, and our broader enterprise information technology environment;
● leveraging
our external service providers, where appropriate, to assess, test, monitor or otherwise
assist with aspects of our security controls;
● training
and awareness programs for employees to drive adoption and awareness of cybersecurity processes
and controls;
● a
cybersecurity incident response plan that includes procedures for responding to cybersecurity
incidents.
In
the last two fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity
incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially
affect us, including our business, results of operations or financial condition, refer to Item 1A. Risk Factors - “Our business
and operations would suffer in the event of system failures or, cyber-attacks or a deficiency in our cyber-security,” which is
incorporated by reference into this Item 1C.
Governance
(Role of Management/Role of the Board)
Our cybersecurity
program and function is overseen by the Director of Information Technology (“Director of IT”), who has over 15 years of experience
leading information technology divisions in various industries. The Director of IT collaborates with all business units to identify and
assess cybersecurity risks and compliance with company policy. The Director of IT stays aware of emerging threats and trends in cybersecurity
through attendance at cyber security conferences, subscription to the CISA.gov mailing list, various tech focused news outlets, and other
sources.
The Audit Committee is responsible for the
oversight of risks associated with cybersecurity threats. The Audit Committee charter provides that the Committee is
responsible for considering the effectiveness of the Company’s internal control system, including information technology
security and control. The Director of IT reports significant cybersecurity events to our Vice President of Administration or Chief
Financial Officer, who then reports such events to our Audit Committee.
Item
2. Properties
Our
headquarters is located in Woburn, Massachusetts, where we lease approximately 16,128 square feet under a lease agreement that has an
initial term expiring in September 2025.