Item 1B. Unresolved Staff Comments
Item 1B.
Unresolved Staff Comments.
None.
Item 1C.
Cybersecurity.
Risk Management and Strategy
The Company understands the importance of managing risks from cybersecurity incidents and utilizes a multilayered strategy guided by the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework for identifying, protecting, detecting, responding to, and recovering from threats and other potential incidents. Key aspects of our strategy for managing risks of cybersecurity threats include:
●
Timely security patching of endpoints and risk-based patching of ICS as applicable where technically feasible, and the implementation of compensating controls (such as enhanced network isolation) for legacy systems that cannot be patched;
● Maintaining strategic inventories of critical legacy ICS hardware and identifying alternative repair sources to mitigate risks associated with the limited availability of original equipment manufacturer (“OEM”) parts and support;
●
Network and endpoint-based monitoring with autonomous protection capabilities to detect and block malicious activity in real-time;
● Utilization of zero -trust principles for remote access and robust network segmentation to isolate manufacturing environments from business networks:
●
Backups which are regularly tested for recovery, including immutable offsite storage and air-gapped copies of critical manufacturing configurations hardened against malicious access;
●
Third-party security services for audit, benchmarking, and improvement of our cyber security program;
●
Ongoing monitoring and evaluation of our cybersecurity posture and performance through regular vulnerability scans, simulated phishing tests, and penetration tests;
● Coordination of security activities with manufacturing schedules to maximize the use of limited maintenance windows for critical system audits and hardware lifecycle refreshes;
●
Oversight of third -party service providers by conducting vendor due diligence upon onboarding and ongoing monitoring of supply chain risks, including the enforcement of least-privilege remote access for third -party technicians;
●
An incident response plan designed to coordinate the activities to prepare, respond, and recover from cybersecurity incidents, prioritizing the safety of personnel, the protection of the environment, and the restoration of business-critical manufacturing systems;
●
Structured management of change process to ensure material changes to our systems or operations have an updated assessment of their potential impact associated with internal and external threats;
● Implementation of acceptable use policies and oversight of emerging technology activity-including AI tools-to prevent the unauthorized disclosure of confidential business information;
●
Ongoing, annual employee security awareness training; and
●
Cybersecurity insurance coverage to help mitigate the risk of loss from cybersecurity incidents.
To date, the Company does not believe that cybersecurity incidents have materially affected the Company, its business strategy, results of operations, or financial condition. The Company cannot provide assurance that it will not be materially affected by any future material cybersecurity incidents. For more information about the cybersecurity risks the Company faces, see Item 1A, Risk Factors, above.
28
Table of Contents
Governance
The Company’s Chief Information Technology Officer (“CITO”) is responsible for developing and implementing our cybersecurity program and has over 20 years of cybersecurity experience. The CITO is responsible for reporting audit findings and risk information to the Company’s Chief Financial Officer (“CFO”). The CFO, in consultation with the CITO and legal counsel, is responsible for the final determination of the materiality of any cybersecurity incident.
Our board of directors is responsible for overseeing our enterprise risk management activities. The Audit Committee of the board of directors oversees our cybersecurity risk and receives reports semi-annually (or more frequently as needed) from our CFO and CITO on cybersecurity risk management and the effectiveness of our ICS security controls. Promptly after becoming aware of a material cybersecurity incident, the CITO works with management to formulate a mitigation plan, ensure compliance with regulatory requirements, and oversee the timely disclosure of material incidents.