Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
Risk Management and Strategy
At IGC, we are committed to
maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we have
implemented a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction
of our information assets. We are committed to ensuring the security and protection of our company’s information assets and the
personal information of our employees, customers, and stakeholders.
We recognize that cybersecurity
threats are constantly evolving and have the potential to cause significant harm to our company and our stakeholders. In order to address
these risks, we have established a cybersecurity risk management framework that is aligned with industry best practices and regulatory
requirements.
Our program includes regular
risk assessments, vulnerability management, access controls, incident response planning, and employee training and awareness programs.
We also work closely with third-party service providers to ensure that they are meeting our cybersecurity standards.
In the event of a cybersecurity
incident, we have established procedures for prompt investigation, containment, and remediation to minimize the impact on our operations
and stakeholders. We believe that our cybersecurity program is robust and effective, and we will continue to invest in and improve our
capabilities to address evolving threats, although there can be no assurance, that our cybersecurity program will prevent all incidents.
We are committed to transparency and will provide updates on any material cybersecurity incidents that may impact our company or our stakeholders.
During Fiscal year ended March
31, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our
business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity
threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these
risks, see Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K.
Governance
Our board of directors addresses
the Company’s cybersecurity risk management as part of its general oversight function. The board of directors’ audit committee
is responsible for overseeing Company’s cybersecurity risk management processes, including oversight and mitigation of risks from
cybersecurity threats.
Our cybersecurity risk assessment
and management processes are implemented and maintained by certain Company management, including our IT Lead. Our IT Lead has 5 years
of experience in roles that include oversight of cybersecurity risk management programs. In addition, the IT Lead is assisted by an external
agency with about 15 years of expertise in cybersecurity.
Our IT Lead is responsible
for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management
strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes,
and reviewing security assessments and other security-related reports.
39
Table of Contents
Our cybersecurity incident
response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including
the CEO, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company’s
incident response processes include reporting to the audit committee for certain cybersecurity incidents.
The audit committee will receive
periodic reports from our management concerning cybersecurity issues, including certain threats and risks and the processes the Company
has implemented to address them, as applicable. The audit committee also has access to various reports, summaries or presentations related
to cybersecurity threats, risk, and mitigation.