Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments.
As a smaller reporting company, we are not required to provide this information.
Item 1C. Cybersecurity.
Risk Management and Strategy
CXApp’s information
security program is designed to identify, assess, and manage risks to the confidentiality, integrity, and availability of the Company’s
information assets and is implemented based on ISO 27001 and SOC 2 frameworks.
Risk Management Program
As part of its information security program, CXApp maintains a risk management program that includes the identification, evaluation, and
treatment of risks across the organization’s information assets, including risks arising from cybersecurity threats. The risk management
program addresses uncertainties related to information assets in order to help ensure that desired business outcomes are achieved. CXApp
performs formal risk assessments on an annual basis to identify security risks related to its corporate operations, products, and services
and initiates appropriate remediation activities where necessary.
CXApp’s information security program is aligned with the Company’s business objectives and establishes processes governing
the identification of risks, assignment of risk ownership, evaluation of how risks impact the confidentiality, integrity, and availability
of information, and determination of appropriate risk treatment methods. A formal risk assessment methodology has been approved by management
and is applied consistently across the organization.
The risk management framework
includes guidelines for identifying and estimating the cost of protective measures designed to eliminate or reduce security risks to
an acceptable level. All operations, products, services, information assets, and information systems that are owned and operated by CXApp
are assessed for risks resulting from threats to the integrity, availability, and confidentiality of the Company’s data.
The risk management program focuses on the following activities:
●
Identification of Strategic Objectives: Alignment of strategic objectives and risk management to avoid a siloed approach to risk management and to support effective risk assessments.
●
Identification of Risks: Ongoing identification and documentation of risks that could affect CXApp’s strategic objectives, security functions, and business continuity.
●
Analysis of Risks: Evaluation of the likelihood and potential impact of identified risks and prioritization of risks relative to one another.
33
●
Mitigation Planning: Development of decisions and actions designed to reduce the likelihood or impact of risks or to improve the Company’s response to risk events.
●
Tracking and Controlling Risks: Ongoing monitoring, reporting, and management oversight of risks and associated mitigation plans, including adjustments in response to
changes in the risk environment.
In
addition to annual risk assessments, CXApp monitors cybersecurity risks on an ongoing basis through security monitoring, vulnerability
management activities, and periodic reassessmen t in response
to significant changes in the threat landscape or business operations.
CXApp
engages independent third-party assessors and auditors in connection with its cybersecurity risk management processes, including for
independent assurance examinations, certification audits, and periodic external testing activities. The Company also maintains processes
to identify and oversee cybersecurity risks associated with third-party service providers, including through vendor risk assessments,
review of independent assurance reports, and contractual security requirements.
Governance
As
part of the risk management program, responsibility for cybersecurity risk management is distributed across the organization and includes
the Information Technology department, system owners, department managers, and executive management.
Management’s Role in Managing Risks
The Information Technology department is responsible for conducting risk assessments and for prioritizing, implementing, and maintaining
appropriate risk-reduction measures identified through the risk assessment process.
Risk owners are individuals who are accountable for ensuring that assigned risks are managed appropriately. Multiple personnel may have
direct responsibility for or oversight of activities designed to manage a given risk and work collaboratively with the designated risk
owner. Responsibilities for the continued development, implementation, and maintenance of the risk management program are assigned internally.
Executive management is responsible for sponsoring and supporting the risk management program and processes, participating in risk management
discussions, and reviewing and approving risk assessments and mitigation plans. As of December 31, 2025, the Company was not aware of
any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or
are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.
For further discussion of risks associated with cybersecurity incidents, see Item 1A. Risk Factors Risks Relating to Cybersecurity
Threats in this Annual Report.
The Company’s Senior
Director of DevOps and IT is responsible for leading the assessment and management of cybersecurity risks and has prior professional
experience in information security, risk management, and technology operations. The Senior Director of DevOps and IT provides regular
reports regarding cybersecurity risks and related matters to executive management, the Audit Committee, and the Board of Directors.
Board of Directors Oversight
The Board of Directors plays an active role by meeting periodically to review the status of the organization’s information security program and roadmap for new cybersecurity risk management initiatives.
The board oversees cybersecurity risk management by evaluating whether management has current cybersecurity policies and procedures, regularly assesses, and monitors cybersecurity risks and receives regular reports on the organization’s cybersecurity posture.
34