What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-31 compared with 2024-05-28 · 99 added, 18 removed, 3 unchanged (98% of the section changed)

2 unchanged sentences

Cybersecurity

We at Faraday Future employ a cybersecurity strategy for addressing cybersecurity risks, security vulnerabilities, and impacts that align with the NIST Cybersecurity Framework (CSF).

The NIST Risk Management Framework (RMF) provides a comprehensive, flexible, and measurable process to manage information security and privacy risks for Faraday Future systems.

This framework outlines standards and guidelines to support the implementation of risk management programs to meet the requirements of the Federal Information Security Modernization Act (FISMA).

The NIST framework promotes the protection of Faraday Future infrastructure .

We utilize the five core functions of the framework which are Identify, Protect, Detect, Respond, and Recover.

Our Information technology security team has a working relationship with our third-party vendors such as Rapid7, Carbon Black and Cisco to provide guidance related to the management of cybersecurity risks.

Our strategy includes both short- and long-term projects to increase the security surrounding our assets by using threat monitoring, threat detection, and SIEM tools within our security systems.

We perform cybersecurity assessments with respect to asset scanning, risk assessments, and vulnerability scans with respect to users in our organization and third parties who provide critical services or who have access to critical confidential data.

We have not identified any cybersecurity threats that have materially impaired or are reasonably likely to materially impair our operations or financial standing.

Our critical business systems are fully redundant and backed up.

Our security systems correlate security events from our SIEM and aggregate security-related incident data, such as malware activity, malicious activities, and ransomware.

Security functionality is continuously monitored by our IT security team and our third party comanaged vendor soc team, and our network traffic is analyzed for signs of malicious activity through the Cyber security systems.

Anti-virus solutions are deployed throughout our organization on servers, laptops and workstations in our data centers, headquarters, and remote sites.

We have hired an independent third-party cybersecurity firm to perform penetration testing annually.

The third-party checks for vulnerabilities on our external and internal network perimeters.

If vulnerabilities are found, corrective actions are implemented to remediate any issues.

Our employees are required to take annual cyber security training designed to help employees guard our cyber and physical data.

Employees are tested on this training.

The Company recognizes the increasing complexity and significance of cybersecurity risks in safeguarding its technology, operations, and customer data.

As an advanced electric vehicle manufacturer, the Company’s operations rely on interconnected digital infrastructure, cloud-based systems, and proprietary software platforms, making cybersecurity an essential component of its risk management framework.

The Company has implemented a comprehensive cybersecurity program designed to identify, assess, mitigate, and respond to cybersecurity risks.

This approach is informed by industry best practices, including the NIST Cybersecurity Framework (“CSF”) and Risk Management Framework (“RMF”).

The program is designed to prevent disruptions to operations, protect critical assets, and ensure compliance with applicable regulations such as the California Consumer Privacy Act (“CCPA”), the General Data Protection Regulation (“GDPR”), and the Securities and Exchange Commission (“SEC”) cybersecurity disclosure requirements.

The following disclosure outlines the Company’s cybersecurity risk management strategy, governance structure, incident response procedures, regulatory compliance efforts, and ongoing investments in cybersecurity.

Cybersecurity Risk Management

The Company employs a structured cybersecurity risk management program that aligns with NIST CSF's five core functions:

Identify, Protect, Detect, Respond, and Recover.

The approach includes:

• Risk Assessments:

Regular evaluations of cyber risks across IT infrastructure, production systems, and cloud-based platforms.

• Threat Detection and Monitoring:

Deployment of Security Information and Event Management (SIEM) tools, intrusion detection systems, and endpoint security solutions to monitor cyber threats in real-time.

• Third-Party Risk Management:

Continuous evaluation of vendors and partners who have access to the Company’s sensitive data and operational networks.

• Access Controls and Encryption:

Implementation of multi-factor authentication (MFA), data encryption protocols, and network segmentation to reduce attack vectors.

The Company integrates cybersecurity into its enterprise risk management (ERM) framework to ensure cyber threats are regularly evaluated as part of its business strategy and operational resilience efforts.

Governance and Oversight

Cybersecurity oversight is a shared responsibility between the Company’s Board of Directors, senior management, and IT security leadership.

The Board receives regular updates on cybersecurity risk exposure, incident response capabilities, and compliance efforts from management.

The Company’s Senior Cybersecurity Engineer leads the execution of cybersecurity programs, including:

• Developing and maintaining security policies.

• Conducting periodic risk assessments and audits.

• Managing incident response and recovery plans.

• Providing reports to senior executives on security trends, vulnerabilities, and ongoing mitigation efforts.

The Company enforces a top-down approach to cybersecurity governance, ensuring accountability and continuous risk monitoring at all levels of the organization.

Management’s Role in Cybersecurity

Management plays an active role in implementing cybersecurity policies, conducting risk evaluations, and ensuring compliance with regulatory requirements.

The IT security team collaborates with third-party cybersecurity vendors, including Rapid7, Cisco, and Carbon Black, to enhance the Company’s security posture.

Management is also responsible for employee training and awareness programs, ensuring that cybersecurity is embedded in the corporate culture.

All employees complete mandatory cybersecurity training to recognize and mitigate phishing attempts, malware threats, and social engineering risks.

Cybersecurity Strategy and Resilience

The Company has established robust cybersecurity resilience measures to ensure that cyber incidents do not materially impact operations.

These include:

• Backup and Redundancy:

Critical business systems are backed up and replicated to prevent data loss and operational disruptions.

• Incident Containment and Recovery:

Automated security responses, real-time malware detection, and forensic analysis capabilities enable the Company to respond swiftly to threats.

• Proactive Threat Intelligence:

Continuous monitoring of emerging cyber threats and industry trends, allowing for adjustments to the security strategy.

The goal is to maintain business continuity, protect proprietary technology, and safeguard customer and employee data in the event of a cyber incident.

Material Cybersecurity Incidents

During the reporting period, the Company experienced a cybersecurity incident related to employee interactions with suspicious websites.

The incident was promptly contained, and a forensic investigation confirmed that no material impact occurred to operations, financial position, or customer data.

Impact of Cyber Incidents

Cybersecurity incidents, if material, could affect the Company’s financial condition, operational stability, and reputation.

Risks include:

• Direct financial losses from remediation costs, potential ransomware payments, or legal expenses.

• Operational disruptions affecting vehicle production and supply chain logistics.

• Regulatory fines and penalties for non-compliance with data protection laws.

Reputational damage impacting customer trust and investor confidence.

The Company regularly assesses its financial exposure to cybersecurity risks and has contingency plans in place to mitigate these impacts.

Board Expertise in Cybersecurity

N o Board members currently hold formal cybersecurity certifications or direct experience in cybersecurity risk management.

The Company continues to enhance Board education on cybersecurity trends and governance practices.

Use of Third-Party Services

The Company partners with third-party cybersecurity firms to support penetration testing, threat monitoring, and risk assessments.

Vendors are required to adhere to stringent security controls to minimize risks associated with third-party data access.

The Company has implemented a Third-Party Risk Management (“TPRM”) framework that evaluates cybersecurity controls in vendor contracts, ensuring compliance with security policies.

Regulatory and Legal Compliance Risks

The Company is subject to global cybersecurity regulations, including:

• SEC cybersecurity disclosure requirements for material incidents and risk management.

• Data privacy laws such as CCPA (California Consumer Privacy Act) and GDPR (General Data Protection Regulation).

• Automotive cybersecurity standards for protecting connected vehicle systems.

Failure to comply with cybersecurity regulations could result in financial penalties, legal liabilities, and reputational harm.

The Company conducts regular compliance reviews to ensure alignment with evolving regulatory requirements.

Incident Response Plan

The Company maintains a formalized incident response plan, which includes:

• 24/7 monitoring for cybersecurity threats.

• Real-time threat detection and forensic investigation tools.

• Collaboration with third-party security firms for penetration testing.

This plan ensures that cyber threats are identified, contained, and mitigated efficiently.

Cyber Insurance and Risk Transfer

The Company maintains cyber insurance coverage to mitigate financial risks associated with cybersecurity incidents.

This insurance covers:

• Incident response and recovery costs.

• Legal fees and regulatory penalties.

• Business interruption expenses.

The risk management team regularly evaluates the adequacy of coverage based on evolving cyber threats.

Historical Cyber Incidents

No material cybersecurity incidents were recorded in prior reporting periods.

Technology and Infrastructure Risks

The Company has implemented:

• Real-time AI-driven security analytics.

• Multi-layered encryption and cloud security protections.

• Strict endpoint security measures across all corporate devices.

Data Security and Privacy Policies

The Company enforces strict data security policies, including:

• Encryption protocols for sensitive data.

• Access controls and multi-factor authentication.

• Regular security audits to verify compliance.

Ongoing Cybersecurity Efforts

The Company continues to invest in:

• Security infrastructure upgrades.

• Cyber awareness training for employees.

• Continuous improvement of risk assessment frameworks.

This structured cybersecurity program ensures compliance with SEC disclosure requirements and supports the Company’s commitment to protecting its assets, customers, and employees from evolving cyber threats.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments