Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments.
None.
Item 1C. Cybersecurity.
Information about cybersecurity risks and Innventure’s risk management processes is collected, analyzed and considered as part of Innventure’s overall enterprise risk management program. In connection with Innventure’s risk management process, the Audit Committee of the Board (the “Audit Committee”) discusses with management and independent auditors the Company’s underlying policies and guidelines with respect to risk assessment and risk management, including with respect to cybersecurity.
45
Measures are in place to mitigate potential risks associated with information technology disruptions and cybersecurity threats. Innventure periodically reassesses risks, implements controls, and performs business continuity and disaster recovery planning. Innventure’s current risk management efforts include threat intelligence gathering, vulnerability assessments, and the integration of cybersecurity technologies. These measures are designed to help protect Innventure’s proprietary systems and customer data from internal and external cybersecurity threats, including third-party systems and services.
Innventure requires mandatory cybersecurity training for employees and periodically initiates phishing simulations to educate employees on potential threats. Innventure also engages with third-party security experts to conduct periodic cybersecurity services and risk assessments. All findings are reviewed by Innventure, and mitigation steps are taken.
As of the date of this Form 10-K, Innventure has had no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Innventure’s business strategy, results of operations, or financial condition. However, there can be no assurances that the policies and processes in place will mitigate all future threats. See “Risk Factors—Cyber-attacks or a failure in Innventure’s information technology and data security infrastructure could adversely affect Innventure’s business and operations.”
Cybersecurity Governance
The Audit Committee is responsible for overseeing the Company’s guidelines and policies with respect to risk assessment and risk management to assess and manage the Company’s exposure to enterprise risk. The Audit Committee periodically reviews and discusses with management the Company’s policies with respect to risk assessment and risk management, including but not limited to cybersecurity and enterprise risk, and steps management has taken to monitor and control such exposures.
Our Senior Director of Information Technology (“IT”) is responsible for assessing and managing risks from cybersecurity threats. Innventure’s Senior Director of IT has a Bachelor’s degree in Accounting and a Master of Business Administration degree. Our Senior Director of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from an external consultant. The external consultant has 20 years of cybersecurity experience. The external consultant also has an Associate’s degree in Database Administration and Network and System Administration. The external consultant also maintains the industry-recognized CompTIA Security+ certification. The Senior Director of IT reports any exposure to risks from cybersecurity threats to our CFO. The CFO is expected to ensure that regular updates are provided to the Audit Committee on risks related to cybersecurity.
46