Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
The safety and security of our customers and team members is our top priority. Republic is committed to safeguarding our information and our information systems from unauthorized access, use, disclosure, disruption, modification or destruction. Our cybersecurity program is designed to protect our information assets and the management of risks to those assets supports the confidentiality, integrity, and availability of the information necessary to our long-term business success. This includes appropriate administrative, physical, and technical safeguards to protect the assets that keep our operation running and securely store the information in our care.
Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management’s design, implementation and enforcement of our cybersecurity risk management program.
Our Board and our Audit Committee receive quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding cybersecurity incidents it considers to be material or potentially material. Audit Committee members also receive presentations on cybersecurity topics from our Chief Information Officer and Chief Financial Officer, supported by our internal security staff, or external experts as part of the Board’s continuing education on topics that impact public companies and update the full Board as necessary.
Our management team, including our Chief Financial Officer and Chief Information Officer , is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers.
Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.
35
Table of Contents
Cybersecurity Risk Management and Strategy
Republic employs a risk-based strategy informed by guiding principles from industry standard cybersecurity and risk management frameworks, such as those published by the National Institute of Standards and Technology (“NIST”), as well as industry guidelines and best practices. This is not intended to imply that we meet any particular technical standards, specifications, or requirements; only that we use various NIST security standards, guidelines and best practices to identify, assess, and manage cybersecurity risks relevant to our business.
As part of our risk-based strategy, Republic maintains appropriate technical and organizational measures and regularly reviews the appropriateness of those controls based on changes to the technical or regulatory environment. Republic also regularly incorporates cybersecurity awareness training into employee communications, engagement and training activities. Republic participates in various information-sharing organizations to timely share and receive threat information, thereby improving the collective defense of the aviation sector. Republic regularly seeks opportunities to improve its capabilities, including through cybersecurity trainings and skill development programs.
Republic utilizes a variety of third parties in connection with its cybersecurity risk management and also utilizes third-party cybersecurity companies to add capacity or expertise when necessary. Additionally, assessments of Republic’s cybersecurity program are periodically conducted by independent third-party assessors.
Republic is subject to cybersecurity risks related to its business partners and third-party service providers. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. A significant data breach may adversely affect Republic’s business. To manage these risks, we conduct evaluations of key suppliers based on risk and seek to incorporate appropriate security standards to manage the risk. Republic also regularly monitors the external cybersecurity posture of select third parties through various service providers.
Republic and its suppliers strive to design and implement technical and organizational controls comprehensively, consistently, and effectively as intended to protect the confidentiality, integrity or availability of systems and data. However, because Republic utilizes a risk-based strategy, based on professional judgment and analysis of the risks, it is possible that Republic may underappreciate or not recognize a specific risk. Moreover, even the best designed and implemented security controls may not eliminate the occurrence of cybersecurity incidents.
Our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our Enterprise Risk Management (“ERM”) framework. Our information security and ERM teams coordinate to regularly review and assess these risks using a wide range of tools and services.
Enterprise-wide training is a vital component to reducing risk and protecting customers, employees and company information. We expect all employees and third-party contractors to adhere to information security and privacy policies as they handle corporate and customer information in their daily jobs. To support this expectation, we require all employees and contractors with access to Republic information to complete annual training, which is updated as new technology, security and privacy issues emerge.
We regularly test our incident response processes through table-top exercises to ensure they continue to be effective as our business and the cybersecurity threat landscape evolve. Our incident response processes are designed to guide the actions we take to prepare for, detect, respond to and recover from cybersecurity incidents.
In the last three years at the time of this filing, we have not experienced any material cybersecurity incidents nor have we identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, financial condition, or the price of our common stock .
36
Table of Contents