Item 1B. Unresolved Staff Comments
Item
1B. UNRESOLVED STAFF COMMENTS
None.
Item
1C. Cybersecurity
Risk
Management and Strategy.
While
no organization can eliminate cybersecurity risk, the Company employs a cybersecurity strategy that is designed to mitigate cybersecurity
and information technology risk. The Company maintains processes to identify, assess, and prioritize cybersecurity risks based on potential
impact to operations, financial objectives, and reputation. These processes include periodic risk assessments, vulnerability identification,
and evaluation of threat intelligence, which are integrated into the Company’s broader enterprise risk management and business
decision-making processes.
The
Company and its contracted providers have implemented practices consistent with the National Institute of Standards and Technology (NIST)
methodology for security. These efforts are implemented to help protect against, and mitigate the effects of, among other things, cybersecurity
incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information
for ransom; destroy data; disrupt or delay our operations or systems; or otherwise cause harm to the Company, our customers, employees,
vendors, or other key stakeholders.
Managing
Material Risks & Integrated Overall Risk Management
Cybersecurity
is part of the Company’s enterprise risk management scope. The Company maintains processes to identify, assess, and prioritize
cybersecurity risks based on potential impact to operations, financial objectives, and reputation. These processes include periodic risk
assessments, vulnerability identification, and evaluation of threat intelligence, which are integrated into the Company’s broader
enterprise risk management and business decision-making processes. In addition, the Company has comprehensive monitoring and employee
training, underscored by a set of policies and procedures that directly or indirectly relate to cybersecurity, such as policies related
to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the
internet, social media, email and wireless devices. Members of the Company’s management work closely with the IT department and
its contracted providers to continuously evaluate and address cybersecurity risks and policies in alignment with the Company’s
business objectives and operational needs. Cybersecurity considerations may also inform the Company’s technology investments, vendor
selection, and operational planning.
27
Use
of Third Parties
The
Company engages cybersecurity consultants and service providers to assess and enhance its cybersecurity practices, and to monitor its
infrastructure in real time for threats. These third parties conduct penetration testing and risk assessments to identify weaknesses
and recommend improvements. Additionally, the Company leverages a number of third-party tools, training and technologies as part of its
efforts to enhance cybersecurity functions. This includes a managed security service provider to augment the Company’s dedicated
security operations team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities,
and a security information and event management solution to automate real-time threat detection, investigation, and prioritization.
The
Company relies on third-party service providers to support certain aspects of its operations, including the processing of sensitive data.
The Company seeks to manage associated risks through vendor selection processes, contractual requirements, and ongoing oversight activities.
However, because these third parties operate their own systems and controls, the Company cannot guarantee the effectiveness of their
cybersecurity measures, and a failure or breach at a third-party provider could adversely affect the Company.
Monitoring
and Response to Cybersecurity Incidents
The
Company, with support from third-party service providers, monitors security alerts on an ongoing basis and conducts periodic reviews
of threat levels, trends, and remediation activities. The team prepares a monthly report on cybersecurity threats and risk areas and
conducts an annual risk assessment. This ongoing knowledge acquisition and continuing education is crucial for the effective prevention,
detection, mitigation, and remediation of cybersecurity incidents. If a security event is alerted, upper management and the incident
response team are notified and the steps identified in the Incident Response Plan, are initiated. The Company’s incident response
processes include defined escalation procedures intended to facilitate timely assessment of whether a cybersecurity incident could be
material. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future
incidents.
Risks
from Cybersecurity Threats
The
Company faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results
of operations, cash flows or reputation. For more information about the cybersecurity risks the company faces, see the risk factor entitled
“Information technology risks, including the risk of cyberattacks, may disrupt our business, result in losses or limit our growth.”
in Item 1A., Risk Factors. The Company has not , to date and based on currently available information, identified cybersecurity incidents
that have materially impaired its operations or financial standing. The Company maintains cybersecurity insurance coverage; however,
such insurance may not be sufficient to cover all losses or liabilities associated with a cybersecurity incident, and coverage may be
subject to exclusions, limitations, and evolving market conditions.
Cybersecurity
Governance
The
Board is acutely aware of the critical nature of managing risks associated with cybersecurity threats and recognizes the significance
of these threats to the Company’s operational integrity and stockholder confidence.
Risk
Management Personnel
The
Company’s Chief Operating Officer and Vice President of IT are responsible for developing and implementing the Company’s
information security program. Additionally, the Vice President of Safety and Risk Management leads ERM for the Company and guides the
handling of all material risks, including cybersecurity. The Chief Operating Officer and VP of Safety and Risk Management have experience
overseeing risk management programs in multiple environments and the Vice President of IT has experience in IT integration, SaaS businesses,
data, application and server security.
28
Board
of Directors Oversight
The
Nominating and Governance Committee is central to the Board’s oversight of cybersecurity risks and bears the primary responsibility
for this domain. The Nominating and Governance Committee is composed of board members with diverse expertise including risk management
and technology, equipping them to oversee this scope effectively.
Management’s
Role Managing Risk and Reporting to the Board
The
Chief Operating Officer has primary interface with the Nominating and Governance Committee on cybersecurity risks, supported by management
and its contracted experts. Briefings to the Nominating and Governance Committee take place on a regular basis, with a minimum frequency
of once per year to cover topics, including:
●
Current cybersecurity landscape and emerging threats;
●
Actions being taken by the Company to minimize or address
such threats;
●
Status of ongoing cybersecurity initiatives and strategies;
●
Incident reports and learnings from any cybersecurity
events, if any; and
●
Compliance with regulatory requirements and industry
standards.
The
Nominating and Governance Committee conducts an annual review of the Company’s cybersecurity posture and the effectiveness of its
risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts
within the overall risk management framework.