Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments.
None.
Item 1C. Cybersecurity.
Risk Management and Strategy
We are subject to various material cybersecurity risks that could adversely affect our business, financial condition, and results
of operations. We have implemented a risk-based approach, guided by Federal Information Processing Standards Publication 199, to
identify, classify, and appropriately assess the range of cybersecurity threats that could affect our business and information systems.
Accordingly, security incidents are, as appropriate to the risk and circumstances, evaluated, classified by severity and prioritized for
response, mitigation and/or remediation. At a high level, our incident response framework consists of five elements: (1) identifying
and managing cybersecurity risks to our systems, assets, data, and other capabilities; (2) implementing safeguards designed to timely
deliver business services; (3) implementing systems and processes designed to detect the occurrence of cybersecurity events; (4)
responding to security events systematically; and (5) utilizing mechanisms designed to enable disaster recovery and business
continuity.
45
Table of Contents
Our cybersecurity program considers industry standards and practices, such as measures in the National Institute of Standards
and Technology (“NIST”) Cybersecurity Framework. Our cybersecurity program develops pragmatic strategies designed to preserve
the confidentiality, integrity and availability of Company and customer information. Pursuant to this approach, we have implemented
controls designed to prevent, detect and mitigate cybersecurity risks posed by third parties. We use various tools and methodologies,
including a written incident response plan and cybersecurity insurance, to manage and mitigate such risk. Those tools and
methodologies are periodically evaluated. Depending on the environments, we monitor and evaluate our cybersecurity posture and
performance through vulnerability scans, penetration tests and threat intelligence feeds. Depending on the environment, we may
conduct red team programming designed to stress test the functioning of our information security systems and assist in identifying
areas of potential vulnerability. Based on the results of these exercises, we attempt to harden any identified exposure points and adjust
our security processes to ensure dynamism and responsiveness.
Along with our in-house cybersecurity capabilities, we also periodically engage third parties to assist with detecting and
responding to cybersecurity risks. Third parties may be engaged to assist with procedures including red and blue team training
exercises and penetration testing. As appropriate to the circumstance, we require third-party service providers with access to important
personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal
standards and industry practices.
Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual
property. To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity
incidents, that have, or are likely to, materially affect us, including our business strategy, results of operation or financial condition.
For more information on the risks from cybersecurity threats that may materially affect us and how they may do so, refer to Part I,
Item 1A. “Risk Factors,” of this Annual Report on Form 10-K, including but not limited to the risk factor titled, “ If our information
technology systems or those of the third parties with whom we work or our data, are or were compromised, we could experience
adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigations;
fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse
consequences.”
Governance
Our information security team is led by our Chief Information Security Officer and is comprised of dedicated professionals
responsible for overseeing cybersecurity risk management and mitigation, incident prevention, detection and remediation. These teams
are spearheaded by professionals that collectively hold decades of cybersecurity leadership experience across multiple industries,
including our Chief Technology Officer. Our leadership working group meets on a weekly basis to discuss our approach to the
rapidly-evolving cybersecurity landscape. To disseminate our top-level strategy throughout the Company, our information security
team provides hands-on and often role-specific training and awareness programs to our employees. Our employees with network
access participate annually in required training, including spear phishing and other awareness training. We also periodically conduct
simulated phishing exercises to practice appropriate response and augment employee awareness of established and emerging cyber
threats.
One of the key functions of our Board of Directors is oversight of our risk management process, including cybersecurity risk.
Our Board of Directors considers cybersecurity risk and mitigation as a critical component of its risk oversight function and continues
to further develop specific cybersecurity oversight functions and pr otocols as we have improved our standing and continue to do so to
meet the reality of the threat climate. Our Board of Directors administers this oversight function directly through the Board of
Directors as a whole, as well as through various standing committees of our Board of Directors , including the Audit Committee, that
address risks inherent in their respective areas of oversight. In particular, our Board of Directors is responsible for monitoring and
assessing strategic risk exposure and our Audit Committee has the responsibility to consider and discuss our major financial risk
exposures, including risks from cybersecurity threats, and the steps our management has taken to monitor and control these exposures,
including guidelines and policies to govern the process by which risk assessment and management is undertaken. The Audit
Committee also monitors compliance with legal and regulatory requirements and is charged with oversight of the adequacy of
Company’s insurance programs, including cyber insurance.