UNRESOLVED STAFF COMMENTS
+Added: Not applicable.
CYBERSECURITY
10 unchanged sentences
Our information technology
−Removed: and cybersecurity function is headed by our Chief Executive Officer (“CEO”), and Director of Information Technology, who
−Removed: are responsible for managerial oversight of our cybersecurity program.
−Removed: Our Director of Information Technology reports directly to the
−Removed: Chief Executive Officer of ImprimisRx and Chief Commercial Officer, who reports directly to our CEO.
+Added: and cybersecurity function is headed by our Chief Executive Officer (“CEO”), and Vice President of Information Technology,
+Added: who are responsible for managerial oversight of our cybersecurity program.
+Added: Our Vice President of Information Technology reports directly
utilize a layered approach in assessing, identifying, evaluating and managing material risks from cybersecurity threats, and leverage
5 unchanged sentences
If we learn of a cybersecurity incident at a third-party service provider , our information technology department will maintain communication
−Removed: with that third-party service provider and communicate any cybersecurity incidents to the Director of Information Technology and CEO.
−Removed: All Harrow employees receive information security training (including data protection and fraud awareness) on an annual basis, and we
−Removed: use industry standard technology to monitor systems for anomalous behavior.
−Removed: We also require employees in certain roles to complete additional
−Removed: role-based, specialized cybersecurity trainings.
−Removed: In the event an incident were to occur, a Security Incident Response Team would be convened
−Removed: that consists of members from many functions, including legal counsel, the Director of Information Technology and the CEO.
+Added: with that third-party service provider and communicate any cybersecurity incidents to the Vice President of Information Technology and
+Added: All Harrow employees receive information security training (including data protection and fraud awareness) on an annual basis, and
+Added: we use industry standard technology to monitor systems for anomalous behavior.
+Added: We also require employees in certain roles to complete
+Added: additional role-based, specialized cybersecurity trainings.
+Added: In the event an incident were to occur, a Security Incident Response Team
+Added: would be convened that consists of members from many functions, including legal counsel, the Vice President of Information Technology
Board of Directors has the ultimate oversight of the Company’s risks—including cybersecurity risks—with our Audit Committee
11 unchanged sentences
Board of Directors at least annually.
−Removed: Finally, in the event a material cybersecurity incident were to occur, the CEO and Director of
−Removed: Information Technology would brief the Audit Committee which would then be responsible for assessing the materiality of the incident
+Added: Finally, in the event a material cybersecurity incident were to occur, the CEO and Vice President
+Added: of Information Technology would brief the Audit Committee which would then be responsible for assessing the materiality of the incident
and making the determination of materiality and any related disclosure.
10 unchanged sentences
to increase in frequency and sophistication.
+Added: 2024, we became aware of a cybersecurity incident that involved unauthorized access of an employee’s email account.
+Added: unauthorized access the threat actor was able to fraudulently divert Company funds to its bank account.
+Added: We detected the incident in a
+Added: timeframe management believes minimized any financial, operational or reputational risk to the Company.
+Added: We believe this early detection
+Added: ultimately resulted in an immaterial impact to our financial results and at no point was our ability to generate revenues disrupted.
more information about the cybersecurity risks and other information technology and data privacy risks we face, see Item 1A.
−Removed: Factors and the subsection titled A breakdown of our information technology systems, or a cyberattack or information security
−Removed: breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected
−Removed: control systems and/or our data, interrupt the operation of our business and/or affect our reputation.
+Added: Factors and the subsection titled A breakdown of our information technology systems, or a cyberattack or information
+Added: security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems,
+Added: network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.