What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-02-25 compared with 2024-02-27 · 26 added, 23 removed, 27 unchanged (64% of the section changed)

4 unchanged sentences

We have implemented multiple and varied processes and technologies for the avoidance, identification, assessment, mitigation, and remediation of risks from cybersecurity threats and incidents designated to protect against the cybersecurity risk landscape.

We are continuously assessing and enhancing our protection, detection, response, and recovery capabilities and regularly engage with the cybersecurity communities including Auto-ISAC, third-party cybersecurity and compliance partners, internal stakeholders, and organizations leading best practices, to support our goals and objectives.

At its core, our cybersecurity risk management program integrates multiple teams across the organization, including our IT, digital and physical product, infrastructure, and legal teams, with leadership and oversight by executive management, the Audit Committee of the Board of Directors (“Audit Committee”), and the Board of Directors (“Board”).

We regularly assess and enhance our protection, detection, response, and recovery capabilities and engage with the cybersecurity communities including Auto-ISAC, third-party cybersecurity and compliance partners, internal stakeholders, and organizations leading best practices, to support our goals and objectives.

Our cybersecurity risk management program integrates multiple teams across the organization, including our IT, digital and physical product, infrastructure, and legal teams, with leadership and oversight by executive management, the Audit Committee of the Board of Directors (“Audit Committee”), and the Board of Directors (“Board”).

To date, Lucid is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Lucid, including our business strategy, results of operations or financial condition.

“Risk Factors” of this Annual Report for further information about our cybersecurity risk.

Board and Committee Oversight

3 unchanged sentences

and (iii) any material cybersecurity threats or incidents.

The Audit Committee and the Board receive regular reporting from Lucid’s management, including our Senior Director of Security and Compliance and Senior Director of Cybersecurity, Data, and Connectivity, on the status of our cybersecurity program and ad hoc reporting on material cybersecurity threats and incidents.

The Audit Committee and the Board receive regular reporting from Lucid’s management, including the leadership of our enterprise IT security and product cybersecurity departments (“Cybersecurity Leaders”) on the status of our cybersecurity program and ad hoc reporting on material cybersecurity threats and incidents.

Management’s Role

At the management level, our information security steering committee, with oversight by our VP of IT and General Counsel, is responsible for leading our cybersecurity risk management program and enterprise cybersecurity matters.

Under the information security steering committee, we have a cybersecurity risk and compliance committee, led by our Senior Director of Security and Compliance and Senior Director of Cybersecurity, Data, and Connectivity, which is primarily responsible for operational review of cybersecurity threats and incidents as part of our incident response process.

The cybersecurity risk and compliance committee receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents.

For potentially material cybersecurity threats and incidents, we escalate these to the information security steering committee, which, with additional oversight and support from our CEO, would raise such threats and incidents to our Audit Committee Chair and, as appropriate, to our Board as they arise.

Our Senior Director of Security and Compliance and Senior Director of Cybersecurity, Data, and Connectivity, and the dedicated personnel on their teams have industry-recognized certifications such as Certified Information Security Manager, Certified information systems security professional, and Boardroom qualified Technology Expert, and experienced information systems security professionals and information security managers with many years of technical cybersecurity management experience.

At the management level, our Information Security Steering Committee (“ISSC”), with oversight by our VP of IT and General Counsel , is responsible for leading our cybersecurity risk management program and enterprise cybersecurity matters.

Under the ISSC, we have various cybersecurity working committees, led by our Cybersecurity Leaders, which are primarily responsible for operational review of cybersecurity threats and incidents as part of our incident response process.

Cybersecurity Leaders receive reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents.

For potentially material cybersecurity threats and incidents, we escalate these to the ISSC, which, with additional oversight and support from our interim CEO, would raise such threats and incidents to our Audit Committee Chair and, as appropriate, to our Board as they arise.

If the cybersecurity incident is determined to be material, disclosure would be filed with the SEC within four business days of determination.

Our Cybersecurity Leaders and the dedicated personnel on their teams have industry-recognized certifications such as Certified Information Security Manager, Certified Information Systems Security Professional, and Boardroom qualified Technology Expert, and experienced information systems security professionals and information security managers with many years of technical cybersecurity management experien ce.

Management of Cybersecurity Risk

Our Cybersecurity Risk Management Processes

Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents by escalating risks, issues, and key decisions to management, the Audit Committee, and our Board.

Our program is designated to protect our products and services, confidential business information (including intellectual property), and employee and consumer data and includes steps for detecting and monitoring cybersecurity threats and incidents, assessing the severity of such threats or incidents, identifying the source of such threats or incidents, including whether such threats or incidents are associated with a third-party vendor or service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management, the Audit Committee, and our Board of potentially material cybersecurity threats and incidents.

In addition, our cybersecurity team provides cybersecurity training to employees during the onboarding process and periodic basis thereafter, with specialized training and tabletop exercises for our core incident response teams and executive management on at least an annual basis.

Under the oversight of the information security steering committee, our cybersecurity risk management program is implemented day-to-day by our cybersecurity team, who engage in identifying, considering and assessing risks from cybersecurity threats and incidents on an ongoing basis;

establishing processes to monitor such cybersecurity risks;

putting in place mitigation and remediation measures;

policy review and development;

product support and deployment;

and maintaining our cybersecurity measures.

Our cybersecurity team also implements ongoing data loss prevention tools and capabilities, customer security measures, incident response measures, and processes for management of third-party vendors and service providers.

Cybersecurity incident response is driven by our Lucid Data and Security Incident Response Plan.

Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents by identifying and escalating risks, issues, and key decisions to management, the Audit Committee, and our Board.

We designed our program to protect our products and services, confidential business information (including intellectual property), and employee and consumer data and includes steps for detecting and monitoring cybersecurity threats and incidents, assessing the severity of such threats or incidents, identifying the source of such threats or incidents, including whether such threats or incidents are associated with a third-party vendor or service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management, the Audit Committee, and our Board of potentially material cybersecurity threats and incidents.

In addition, our cybersecurity team provides cybersecurity training to employees during the onboarding process and on a periodic basis thereafter, with specialized training and tabletop exercises for our core incident response teams and executive management on at least an annual basis.

Under the oversight of the ISSC, our cybersecurity risk management program is implemented day-to-day by our cybersecurity team, who identifies, considers, and assesses risks from cybersecurity threats and incidents on a regular basis;

establishes processes to monitor such cybersecurity risks;

provides mitigation and remediation measures;

engages in policy review and development;

provides product support and deployment;

and maintains our cybersecurity program.

Our cybersecurity team also implements data loss prevention tools and capabilities, customer security measures, incident response measures, and processes for management of third-party vendors and service providers.

Our cybersecurity incident response is driven by our Lucid Data and Security Incident Response Plan.

Based upon the severity assessment and ranking, incidents are handled by the relevant teams for technical, operational, and legal risk management.

Lucid has also implemented processes to integrate our cybersecurity risk management processes into our overall enterprise risk management system including within our greater product management, personnel management, and third-party vendor and service provider management processes.

In addition, Lucid has implemented processes to integrate our cybersecurity risk management processes into our overall enterprise risk management system including within our greater product management, personnel management, and third-party vendor and service provider management processes.

Third-Party Auditors and Consultants in Cybersecurity Risk Management

Our cybersecurity team also periodically engages third-party cybersecurity experts for risk assessment and system enhancements.

We utilize third-party auditors and assessors in connection with our cybersecurity risk management program to identify gaps and develop policies, procedures, and strategies designed to improve the program posture.

We also use third-party consultants to obtain and will use them to maintain relevant organizational cybersecurity certifications, including UN Regulation 155 Vehicle Cybersecurity Approval.

2 unchanged sentences

Cybersecurity Risk Management of Third-Party Vendors and Service Providers

We have also implemented risk management practices designed to minimize the material cybersecurity risks that arise from utilizing third-party vendors and service providers that receive or have access to Lucid confidential information or personal data.

We have also implemented risk management practices designed to minimize cybersecurity risks that arise from utilizing third-party vendors and service providers that receive or have access to Lucid confidential information or personal data.

In order to oversee and identify such risks, we have implemented the following processes:

5 unchanged sentences

While we are in the process of increasing the resiliency of these capabilities across the board, our control over and ability to monitor the security posture of third-party vendors and service providers remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties.

Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

In addition, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments