Item 1B. Unresolved Staff Comments
ITEM 1B. Unresolved Staff Comments.
None
ITEM IC. Cybersecurity.
56
Table of Contents
Cybersecurity Risk Management and Strategy
Our management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations, and our reputation. We have identified cybersecurity as a critical business risk as part of our overall risk management strategy, which our board of directors oversees.
We have implemented an information security management system in accordance with our risk profile and business that is designed to protect the Company, our employees, and our customers from cybersecurity threats. This system, which is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, includes, among other things, written policies, technical controls, and employee training. We have also developed an incident response policy and procedure designed to facilitate the handling of cybersecurity incidents.
Our cybersecurity risk management program, which is part of our enterprise risk management program, aims to identify risks from cybersecurity threats. Our cybersecurity risk management program includes a number of components, including informal self-assessments, penetration testing, and vulnerability assessments. Our managed security services provider helps us implement additional security controls, including malware protection and network security tools.
We take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor’s programs. We use a third-party tool to assess the degree of risk posed by the vendor, and are in the process of developing a vendor security questionnaire.
We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and cybersecurity incidents that could affect our information or systems. For more information, see Item 1A. Risk Factors.
Governance Related to Cybersecurity Risks
Our vice president of information technology (“VP of IT”) is responsible for the strategic leadership and direction of the Company’s information security management system. Our VP of IT has 25 years experience managing IT teams, including 10 years managing IT security teams. Led by the VP of IT, along with our Senior Manager of IT Security, the IT leadership team meets at least annually, and more frequently as needed, to review the Company’s cybersecurity objectives and take steps to further the suitability and effectiveness of the Company’s information security program. The output from these meetings are reviewed periodically with senior management. We are also in the process of establishing a cybersecurity management committee comprised of IT, communications, finance, legal and product personnel.
The board and Audit Committee oversee the management of risks by the Company’s executives. The Audit Committee, pursuant to its charter, is responsible for reviewing the Company’s cybersecurity program and risks, as identified by Company management, and the steps that Company management has taken to protect against threats to the Company’s assets including information systems and data security. The VP of IT provides updates to the Audit Committee approximately annually, which include, as appropriate, a description of risks from cybersecurity threats.