Item 1B. Unresolved Staff Comments
ITEM 1B.
Unresolved Staff Comments
None.
ITEM 1C.
Cybersecurity
Risk Management and Strategy
We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through our information
systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As we grow, we plan to develop a more robust and detailed strategy for cybersecurity in
alignment with nationally accepted standards.
Our cybersecurity program is overseen by our head of human resources, information technology (IT) and facilities, who manages our third-party providers of IT services. We
have engaged contractors to provide cybersecurity standards, architecture and processes. As part of our service agreement with our contractors, we receive identification and reporting of risks to our management and board. Our information
technology team maintains a security operations center intended to identify anomalous activity. Further, our policies require all employees to notify our compliance, legal or information technology functions in the event of a cybersecurity
incident.
As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have
materially affected us, including our business strategy, results of operations or financial condition. Our business depends on the availability, reliability and security of our and our third-party contractors’ information systems, networks and
data.
As discussed under “Risk Factors” in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of
operations and financial condition. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors: “Our business and operations would
suffer, and could be negatively affected, in the event of system failures or cyberattacks .”
Governance
Our management oversees and reviews any reports of cybersecurity risks or breaches provided by our third-party providers of IT services. Additionally, management assesses
potential improvements to our cybersecurity policies and procedures based on recommendations from third-party experts, including our providers of IT services, in a matter that’s suitable for a company our size and nature.
One of our Board’s key functions is informed oversight of our risk management process, including risks from cybersecurity threats. The Board does not have a standing risk
management committee, but rather administers this oversight function directly through the Board as a whole, as well as through various Board standing committees that address risks inherent in their respective areas of oversight. Our Audit
Committee has the responsibility to review and discuss with management and KPMG LLP, the Company’s independent auditors, as appropriate, our guidelines and policies with respect to risk assessment and risk management, including our major
financial risk exposures and the steps taken by management to monitor and control these exposures, including as it concerns risks from cybersecurity threats. In general, we seek to address cybersecurity risks through a cross-functional approach
that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents
when they occur.