Item 1B. Unresolved Staff Comments
ITEM
1B. UNRESOLVED STAFF COMMENTS
None.
ITEM
1C. CYBERSECURITY
Cybersecurity
Risk Management and Strategy
We
have developed and maintained a Cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability
of our critical systems and information. Our Cybersecurity risk management methodology is integrated into our overall enterprise risk
management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal,
compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have
instituted a Cybersecurity awareness campaign designed to identify, assess and manage material risks from Cybersecurity threats, including
by engaging a third-party Cybersecurity service provider, which communicates directly with our management and compliance personnel. The
cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and
networks, including networks on which we rely. Through our Cybersecurity awareness, the current threat landscape is actively monitored
in an effort to identify material risks arising from new and evolving Cybersecurity threats. We may engage external experts, including
Cybersecurity assessors, consultants, and auditors to evaluate Cybersecurity measures and risk management processes as needed. We also
depend on and engage various third parties, including suppliers, vendors, and service providers in connection with our operations. Our
risk management, legal, and compliance personnel oversee and identify, including through a third-party Cybersecurity service provider,
material risks from Cybersecurity threats associated with our use of such entities.
Our
Cybersecurity risk management methodology includes:
●
risk assessments designed to help identify material Cybersecurity risks to our critical systems, information, services, and our broader
enterprise IT environment;
●
individuals, including employees and external third-party service providers, who are responsible for managing our Cybersecurity risk
assessment processes, our security controls, and our response to Cybersecurity incidents;
●
the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;
●
Cybersecurity awareness training of our employees, incident response personnel, and senior management;
●
a Cybersecurity incident response plan that includes procedures for responding to Cybersecurity incidents; and
●
a third-party risk management process for service providers, suppliers, and vendors.
We
have not identified risks from known Cybersecurity threats, including as a result of any prior Cybersecurity incidents that have materially
affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from Cybersecurity
threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations,
or financial condition.
Cybersecurity
Governance
Our
Board provides strategic oversight on Cybersecurity matters, including material risks associated with Cybersecurity threats. The Board
has delegated to the Audit Committee oversight of Cybersecurity and other information technology risks. The Audit Committee oversees
management’s implementation of our Cybersecurity risk management methodology. Our Board and the Audit Committee receive periodic
updates from our Chief Financial Officer and more frequently as needed , regarding the overall state of our Cybersecurity preparedness,
information on the current threat landscape, and material risks from Cybersecurity threats and Cybersecurity incidents. The Audit Committee
and our management team are informed about and monitor the prevention, detection, mitigation, and remediation of Cybersecurity incidents ,
including through the receipt of notifications from third-party service providers and reliance on communications with our risk management,
legal, and/or compliance personnel.
The
Audit Committee reports to the full Board regarding Cybersecurity activities. The full Board also receives briefings from management
on cyber risk issues and best practices. Our management team is responsible for assessing and managing our material risks from Cybersecurity
threats . The team has primary responsibility for developing and maintaining our overall Cybersecurity risk methodology and supervises
both our internal Cybersecurity personnel and our retained external Cybersecurity consultants. Our management team supervises efforts
to prevent, detect, mitigate, and remediate Cybersecurity risks and incidents through various means, which may include briefings from
internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including
external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.
25