Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
RISK MANAGEMENT AND STRATEGY
We have implemented and continue to maintain a comprehensive information security program designed to identify, assess, and manage material risks from cybersecurity threats. This program is integrated into our overall enterprise risk management process, ensuring that cybersecurity considerations are incorporated into the Company’s broader strategic planning and risk oversight. The Board maintains ultimate oversight of the Company's risk management strategy. The Board has delegated primary responsibility for the oversight of cybersecurity risks to the Technology Committee of the Board ("Technology Committee"), which is responsible for: (i) regularly reviewing with executive management significant cybersecurity, privacy, artificial intelligence, and IT risks, as well as our policies and processes for risk assessment; (ii) overseeing the steps management has taken to monitor and control such risks; and (iii) regularly reporting its findings to the full Board.
18
Table of contents
Our information security program is operationally led by the Director of Information Security, who is responsible for the day-to-day execution of our information security strategy, security engineering, operations, and cyber threat detection. The program utilizes a defense-in-depth approach, employing policies and procedures to guide the implementation and maintenance of security measures. We utilize a risk-based methodology to select and implement security controls, relying on the analysis and judgment of the Director of Information Security and executive management, supplemented by feedback from internal and third-party audits. When identifying security controls, we consider factors such as the likelihood and severity of a risk, the potential impact on the Company and its stakeholders, the feasibility of controls, and the impact on business operations.
We recognize that cybersecurity risks extend to our service providers. We maintain a vendor risk management program to oversee risks related to the use of third-party technology and services, including cloud-based platforms. We engage third-party security firms to assist in the operation of specific controls and to conduct independent assessments, such as vulnerability scans and penetration testing.
To ensure preparedness, we maintain a written incident response plan and conduct tabletop exercises to test our response capabilities. We also maintain distinct response protocols to address operational impacts caused by service disruptions, including scenario-specific runbooks and mitigation plans for critical vendors. Employees are required to undergo security awareness training upon hiring and annually thereafter.
GOVERNANCE
While the Board oversees the Company's risk strategy, the Company's executive management is responsible for the strategic assessment and management of cybersecurity risk. The Director of Information Security serves as the operational lead for the development, maintenance, and enforcement of the information security program. The Director of Information Security reports to executive management to ensure that cybersecurity risks are reviewed and evaluated.
The Director of Information Security possesses over 20 years of cybersecurity expertise, including service in the United States Air Force and subsequent roles in both the public and private sectors across diverse industries. The Director holds multiple industry-recognized certifications, including the Certified Chief Information Security Officer (CCISO), Certified Information Systems Security Professional (CISSP), and Certified Information Security Manager (CISM).
The Director of Information Security briefs the Technology Committee regularly and facilitates cybersecurity training for the Board, covering the current threat landscape, program metrics, risks, and the security roadmap.
In the event of a security incident, the Director of Information Security is responsible for executing the technical response and notifying the Company’s Crisis Committee, a cross-functional group of senior Company leaders. The Crisis Committee works with the Director of Information Security to coordinate the response and remediation efforts.
The authority to determine whether a cybersecurity incident is material resides with the Company’s executive management. In the event of a potential material incident, the Director of Information Security and the Crisis Committee escalate the matter to the Company’s General Counsel and Principal Accounting Officer. These executive officers, in consultation with outside counsel, are responsible for assessing the materiality of the incident. The General Counsel is responsible for notifying the Technology Committee and the Board of any incident determined to be material.
As of the date of this report, the Company has not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, there can be no assurance that the Company, or third parties on which it relies, will not experience a cybersecurity threat or incident in the future. We continue to monitor cyber risk closely; however, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. Risk factors for a discussion of cybersecurity risks.
19
Table of contents