Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments.
None.
Item 1C. Cybersecurity.
Cyber Risk Management and Strategy
We rely on information technology systems and cloud-based services to support our business operations, including collaboration, communication, and the storage and processing of information. These systems include platforms and services that are operated by us and by third-party providers.
We have developed and implemented a cybersecurity program with certain processes for assessing, identifying and managing cybersecurity risk, which are intended to manage risk and protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our cybersecurity program with reference to the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”).
Our cybersecurity risk management activities and processes are supported principally by internal personnel and third-party service providers , including an outside information technology management/cybersecurity consultant, which provide information technology support, cybersecurity operations, and infrastructure and security engineering services, including procedural and technical safeguards, response plans, incident simulations and routine review of our policies and procedures to identify risks and refine our practices.
Key elements of our cybersecurity program include, but are not limited to, the following:
• identity and access management controls, including multi-factor authentication using Microsoft Entra ID;
• email security controls designed to help detect and prevent phishing and other email-based threats;
• endpoint management and security controls, including device management and patching using Microsoft Intune;
• network security controls, including perimeter firewalls and outbound web filtering at our office location;
• periodic security awareness training for employees; and
• phishing simulation campaigns conducted periodically to reinforce employee awareness and support identification of potential social engineering risks.
We also take a risk-based approach to evaluating third-party vendors and service providers based on their access to our systems and information and their criticality to our operations. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.
We have not identified any cybersecurity incidents that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Like other companies, we face risks from cybersecurity threats that could result in unauthorized access to systems or information, service disruptions, or other impacts.
Governance Related to Cybersecurity Risks
Our Chief Accounting Officer and management are responsible for the day-to-day oversight of cybersecurity risk management, including coordinating with our managed service provider to support cybersecurity operations and infrastructure and security engineering efforts. Management periodically reviews cybersecurity risks and the steps taken to monitor and manage such risks. Our Chief Accounting Officer has many years of experience overseeing company-wide information technology risks, and is supported by our outside information technology management/cybersecurity consultant.
Our audit committee oversees risks from cybersecurity threats as part of its broader risk oversight responsibilities. The audit committee receives periodic updates from our Chief Accounting Officer and management regarding cybersecurity matters, including material risks and, if applicable, significant cybersecurity incidents.
105