Item 1B. Unresolved Staff Comments
Item
1B. Unresolved Staff Comments
Not
applicable.
Item
1C. Cybersecurity
Risk
Management and Strategy
We
have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity , and availability
of our critical systems and information. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity
Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather
that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
33
Key
elements of our cybersecurity risk management program include:
●
risk
assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise
information technology environment;
●
leveraging
our external service providers, where appropriate, to assess, test, monitor or otherwise assist with aspects of our security controls ;
●
training
and awareness programs for employees to drive adoption and awareness of cybersecurity processes and controls;
●
a
cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.
In
the last two fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity
incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially
affect us, including our business, results of operations or financial condition, refer to Item 1A. Risk Factors - “Our business
and operations would suffer in the event of system failures or cyber-attacks,” which is
incorporated by reference into this Item 1C.
Governance
(Role of Management/Role of the Board)
Our
cybersecurity program and function is overseen by the Director of Information Technology (“Director of IT”), who has over
15 years of experience leading information technology divisions in various industries. The Director of IT collaborates with all business
units to identify and assess cybersecurity risks and compliance with company policy. The Director of IT stays aware of emerging threats
and trends in cybersecurity through attendance at cyber security conferences, subscription to the CISA.gov mailing list, various tech
focused news outlets, and other sources.
The
Audit Committee is responsible for the oversight of risks associated with cybersecurity threats. The Audit Committee charter provides
that the Committee is responsible for considering the effectiveness of the Company’s internal control system, including information
technology security and control. The Director of IT reports significant cybersecurity events to our Chief Financial Officer, who then
reports such events to our Audit Committee .
Item
2. Properties
Our
headquarters is located in Woburn, Massachusetts, where we lease approximately 11,400 square feet under a lease agreement with an initial
term expiring in February 2031.