Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
Not applicable.
Item 1C. Cybersecurity
Risk
Management and Strategy
We have established policies and processes
for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these processes into our overall
risk management program. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted
through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information
systems or any information residing therein.
We have adopted as the governance framework
for our cybersecurity program the Service Organization Control Type 2 (SOC2) and the Health Insurance Portability and Accountability Act
(HIPAA). We use this framework as a guide to help us identify, assess, respond to, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program includes:
• periodic risk assessments designed to help identify material cybersecurity risks to our critical systems,
information, and our broader enterprise information technology environment;
• skilled information security and data privacy personnel, who support our cybersecurity risk assessment
processes, our security controls, and our response to cybersecurity incidents;
• external service providers, where appropriate, to monitor, assess, test, or otherwise assist with aspects
of our security controls, and to support risk mitigation efforts;
• training for our employees on cybersecurity awareness and the importance of protecting information assets.
• periodic reviews of key cybersecurity policies, and updating as needed;
• a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.
We have not
identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially
affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
Governance
Our Board considers cybersecurity
risk as part of its risk oversight function and management expects to keep the Board informed of any material cybersecurity threats and
expects to provide a report to the Board on a periodic basis and the Board will consider and oversee.
55
Our management team is responsible
for assessing and managing our material risks from cybersecurity threats. Our Chief Technology Officer leads a team of information security
professionals who have primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel
and our external cybersecurity consultants.
Our management
team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may
include threat briefings from internal personnel and external service providers, as well as alerts and reports produced by security tools
deployed in the information technology environment.