Item 1B. Unresolved Staff Comments
Item
1B. Unresolved Staff Comments
None.
Item
1C. Cybersecurity
We
maintain an information security and cybersecurity program, as well as a cybersecurity governance framework, which are designed to protect
our information systems against operational risks related to cybersecurity.
Cybersecurity
Risk Management and Strategy
We
recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats which include,
among other things, operational risks, intellectual property theft, fraud or extortion, harm to employees or customers, violation of
privacy or security laws and related litigation and legal risk, and reputational risks.
We
have developed and implemented a cybersecurity risk management program overseen by our Audit Committee intended to protect the confidentiality,
integrity, and availability of our critical systems and information, and detect and contain any cybersecurity incidents that impact us.
The program is integrated into our overall risk management systems and processes and includes a cybersecurity risk assessment process
that routinely evaluates potential impacts of cybersecurity risks on our business, including risks from cybersecurity threats associated
with our use of third-party service providers. These assessments inform our cybersecurity risk mitigation strategies. The results are
regularly shared with our information technology committee comprised of our Vice President of Information Technology, our Information
Technology Manager, our President and our Chief Financial Officer (the “IT Steering Committee”) and the Audit Committee of
our Board as part of the committees’ involvement in managing and overseeing cybersecurity risks.
Our
cybersecurity risk management program also includes processes to triage, assess the severity of, escalate, contain, investigate, and
remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.
If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures
define the steps to determine materiality and disclose such a material cybersecurity incident.
In
addition, we engage an independent third-party provider in connection with our cybersecurity risk management program to monitor cybersecurity
threats and provide certain security measures. We regularly engage with this provider to aid in the identification and remediation of
potential threats. This provider has qualifications that include Microsoft Certified: Security, Compliance, and Identity Fundamentals,
Certified Information Systems Security Professional (CISSP), Certified Hacking Forensic Investigator, Certified Ethical Hacker (CEH)
and Security+.
While
we believe that our business strategy, results of operations or financial condition have not been materially adversely affected by any
cybersecurity incidents, cybersecurity threats are pervasive and, similar to other institutions, we, as well as our employees, customers,
regulators, service providers, and other third parties have experienced a significant increase in information security and cybersecurity
risk in recent years and will likely continue to be the potential target of cyber-attacks. We continue to assess the risks and changes
in the cyber environment and invest in enhancements to our cybersecurity capabilities as deemed necessary to promote advancements in
our cybersecurity capabilities.
Cybersecurity
Governance
Our
cybersecurity risk management program is overseen by the Audit Committee and led by the IT Steering Committee. Our Audit Committee is
responsible for overseeing risks from cybersecurity threats and has the authority to regularly review the adequacy of our cybersecurity,
information and technology security, and data privacy programs, procedures, and policies. Our IT Steering Committee, led by the Vice
President of Information Technology, is primarily responsible for monitoring, assessing, and managing material risks from cybersecurity
threats.
The
Audit Committee regularly receives updates from the IT Steering Committee / management with respect to our efforts to manage data protection,
cybersecurity, and information and technology risks, and assesses the results of reviews from internal audits. Materials presented to
our Audit Committee by our IT Steering Committee include updates on our data security posture, results from internal audit and third-party
assessments, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management
has taken to respond to such risks. The Audit Committee / IT Steering Committee also regularly engages in management on technology risk-related
topics.
Our
processes also allow for our Board and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule.
While the Audit Committee meets periodically, the Audit Committee is authorized to meet with management or individual directors at any
time it deems appropriate to discuss matters relevant to the committee. Our policy is for the Board and the Audit Committee to receive
prompt and timely information regarding any cybersecurity risk (including any incident) that meets reporting thresholds, as well as ongoing
updates regarding any such risk.
9