Lifeway Foods, Inc. 10-K

ITEM 1B. UNRESOLVED STAFF COMMENTS None. ITEM 1C. CYBERSECURITY Risk Management and Strategy Our cybersecurity program is designed to assess, identify, and manage material risks from cybersecurity threats, and protect and preserve the confidentiality, integrity , and continued availability of all information owned by, or in the care of, the Company. Cybersecurity risks are incorporated into the Company’s broader risk management process to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. As part of the cybersecurity program, we utilize a combination of internal technology, which we continue to analyze and update as necessary, and a third-party managed security service provider and their platform to monitor, evaluate and respond to cyber activity. We monitor and assess the information gathered by our security tools and services to identify gaps, exposures, or weaknesses in our overall security approach, and make the necessary changes to address such findings. Impact of Cybersecurity Risks and Threats We are not aware of having experienced any risks from cybersecurity threats or incidents through the date of this Report that have materially affected the Company, its business strategy, results of operation or financial condition or are reasonably likely to have such an effect over the long term. This does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. Additional information on cybersecurity risk we face is discussed in Part I, Item A – Risk Factors, which should be read in conjunction with the foregoing information. Governance Board of Directors Our Board of Directors oversees our risk management process, and cybersecurity risks are monitored as a part of the broader program. Our Board has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit and Corporate Governance Committee. The Chief Financial Officer and our Director of IT present updates to the Audit and Corporate Governance Committee and the full Board of Directors , on, among other things, the Company’s cyber risks and threats, the status of projects to strengthen the Company’s information security systems, and the emerging threat landscape. 17 Management Our Chief Financial Officer is responsible for management oversight of our information security program and controls, which includes cybersecurity risk management. Our Director of IT is responsible for the development, operation, and maintenance of our information security program and controls. The Director of IT has extensive experience in the information technology field, and cybersecurity knowledge and skills gained through relevant experiences. The Director and Chief Financial Officer regularly review potential risks and measures implemented by the Company to identify and mitigate cyber security risks.