Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
Risk Management and Strategy
PMI’s cybersecurity risk management process is designed to identify and assess internal and external cybersecurity threats and vulnerabilities to and within the Company’s business and operations and to analyze and prioritize risks from cybersecurity threats to inform strategies and action plans aimed at mitigating and managing these risks.
PMI’s cybersecurity program utilizes a variety of technical and process controls that are designed to identify, protect against, detect, respond to, and recover from cybersecurity threats, including:
•
dedicated cybersecurity professionals who are responsible for analyzing cybersecurity threats, defining cybersecurity policy and requirements, implementing protections, and monitoring and responding to cybersecurity incidents;
•
periodic cybersecurity awareness training for relevant employees and contractors on PMI policies and emerging cybersecurity threats, including phishing awareness training;
•
internal and third party cybersecurity testing, including penetration testing of PMI’s information systems and hardware;
•
cybersecurity risk assessments for PMI’s systems and applications;
•
cybersecurity monitoring and response processes intended to identify, assess, escalate, investigate, contain, and remediate incidents; and
•
disaster recovery plans.
In addition, risks from cybersecurity threats are integrated into the Company’s enterprise risk management ("ERM") program. The ERM program establishes a risk management framework that seeks to identify and assess risks that could materially impact PMI’s business and operations.
As part of PMI’s cybersecurity program, the Company regularly engages with assessors and third -party advisers to perform various services, including (i) assessments of process design and operating effectiveness; (ii) security testing and attestation; (iii) periodic assessment of enterprise cybersecurity maturity; (iv) industry benchmarking; and (v) thought leadership related to continuous improvement of processes, training, technology, and data.
32
Table of Contents
PMI’s cybersecurity program also aims to identify and assess cybersecurity risks associated with its use of third -party service providers with access to the Company’s systems and data, as well as such third -party service providers’ adherence to certain cybersecurity standards and processes. As appropriate, PMI requires such third -party service providers to agree to be subject to cybersecurity evaluations by the Company.
A discussion of how PMI’s business, results of operations, and financial condition could be materially adversely affected by risks from cybersecurity threats is contained in Item 1A. Risk Factors under “ Picard depends on sophisticated information systems and maintains protected personal data, and a significant cybersecurity incident or other disruption affecting these information systems or protected personal data could have a material adverse effect on Picard ’ s business, financial condition and results of operations."
Governance
The Board has risk oversight responsibility for PMI, which it administers directly and with assistance from its committees. Throughout the year, the Board and its committees engage with management to discuss a wide range of enterprise risks.
The audit committee assists the Board in fulfilling its oversight responsibilities with respect to ERM, including risks from cybersecurity threats, and the steps management has taken to monitor and mitigate those risks. The audit committee receives reports semiannually from the Chief Finance Officer on the Company's cybersecurity strategy and program. In addition, the audit committee conducts an annual review of the ERM process, including the program structure, risk assessment, and risk mitigation.