Item 1B. Unresolved Staff Comments
Item 1B . Unresolved Staff Comments
None.
Item 1C. Cybersecurity
The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of company data and systems along with other material risks to company operations, at least annually or whenever there are material changes to the Company’s systems or operations. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches . As part of our risk management process, the Company engages outside providers to conduct periodic penetration testing and other cybersecurity audits. The Company stores company data in cloud environments with security appropriate to data involved and has adopted controls around, among other things, vendor risk assessment, information classification, access and acceptable use and backup and recovery.
The Company's Senior Vice President of IT Security ("SVP of IT Security") has over 35 years of experience in the informational technology field, with 19 years of healthcare IT experience with an emphasis in IT security and computer forensics . The SVP of IT Security has operational responsibility for ensuring the adequacy and effectiveness of the company’s risk management, control and governance processes, who periodically reports to the Operational Risk Committee ("ORC"), responsible for applying the policy decisions and, in coordination with the Chief Digital Officer and Chief Executive Officer, reports to the Board of Directors at least annually or more regularly at the discretion of the ORC.
The Audit Committee of the Board of Directors is briefed on cybersecurity risks at least once each calendar year and also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds. The SVP of IT Security reports quarterly to the Audit Committee and such report addresses overall assessment of the Company’s compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, recommendations for changes and/or updates to policies and procedures .
36
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.