ELITE PHARMACEUTICALS INC /NV/ 10-K

ITEM 1B. UNRESOLVED STAFF COMMENTS None. 44 ITEM 1C. CYBERSECURITY Risk Management & Strategy Elite maintains a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. This program addresses cybersecurity risks to corporate information technology, or IT, environment including systems, hardware, software, data, people and processes. The underlying processes and controls of Elite’s cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including principles of the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework 2.0 (“CSF”), and processes and controls supporting data protection requirements under applicable law. NIST CSF offers a thorough set of guidelines and best practices to help establish a strong cybersecurity posture. Aligning our cybersecurity processes and controls to NIST CSF enables us to systemically identify, assess, and manage cybersecurity risks most relevant and impactful to our business operations. It is important to note that using the NIST CSF as a guide does not imply our cybersecurity program meets any specific technical standards or requirements. Elite engages a third-party specialist to perform an annual assessment of its cybersecurity risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. Elite, in conjunction with its third-party cyber risk management specialists, develops a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process. In evaluating the risks identified through the annual cybersecurity risk assessment process, our cybersecurity specialists and partners, including but not limited to Managed Service Providers, assist Elite to assess and prioritize the likelihood, severity, and impact of relevant risks, including the impact on employees, stakeholders, and vendors. In addition, Elite maintains governance processes and controls designed to protect Elite’s IT assets, data, and services from threats and vulnerabilities. Elite employs key practices within the cybersecurity risk management program including maintaining restricted access to privileged accounts, intrusion prevention systems/detection systems including maintenance of protection systems such as firewalls, network and data traffic monitoring, and critical data backups to mitigate cybersecurity risk. Elite’s cybersecurity partners, including consultants and other third-party service providers, are a key part of Elite’s cybersecurity risk management strategy and infrastructure. Elite partners with industry-recognized cybersecurity providers leveraging third-party technology and expertise and engages with these partners to monitor and maintain the performance and effectiveness of IT assets, data, and services that are deployed in company data and technology environment. The cybersecurity partners provide services necessary to maintain Elite’s IT infrastructure and execute the current cybersecurity strategy, including continuous improvement and remediation efforts. Elite monitors service level agreements and third-party contracts as part of our efforts to monitor third-party risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to service disruption or an adverse cybersecurity incident. Our cybersecurity risk management program includes an incident response plan that includes relevant and critical members of management and third-party service providers alike. This team is responsible for assessing and managing cybersecurity incident response processes, response times, and communication plans in the event corrective actions and mitigation procedures are required to isolate and eradicate an incident. Governance & Oversight Elite’s management team, with assistance from cybersecurity service providers, is responsible for oversight and administration of Elite’s cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Elite’s management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via the use of strategic third-party partners. Elite’s management team also relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by Elite for strategic cyber risk management, advisory and decision making. The Audit Committee of the Board of Directors oversees Elite’s cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including members of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of Elite’s cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on processes to prevent, detect, and mitigate cybersecurity incidents. Elite faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Elite acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, as of the date of this Annual Report on Form 10-K, Elite is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect Elite’s business strategy, financial condition, results of operations, or cash flows. Elite proactively seeks to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to Elite’s service delivery; however, potential vulnerabilities to known or unknown threats will still remain. Further, there are continuous regulatory considerations regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject Elite to additional liability and reputational harm. In response to such risks, Elite has implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. “ Risk Factors ” for more information on cybersecurity risks. 45