Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
35
Item 1C. Cybersecurity
Risk Management and Strategy
The success of our business
operations depends on the security, confidentiality, integrity and availability, of confidential and sensitive information. Such information
includes personal information that we collect and process on our own and using systems and platforms provided by our vendors and other
third parties on which we rely. Consequently, we maintain a data protection program, which includes physical, technical, and administrative
safeguards, designed to identify, prevent, and mitigate the risks posed by cybersecurity threats, and to identify, analyze, address, mitigate
and remediate any cybersecurity incidents that may happen in an efficient and timely manner. As part of our program:
● We have implemented and maintain our policies, procedures and processes (PPP) related to the functioning of information technology
within the company. The PPP are custom-tailored for the specific needs of the company – such as the nature and scale of the personal
information that we collect and process – and incorporate controls and frameworks set forth by organizations such as the National
Institute of Standards and Technology and the International Organization for Standardization. Our internal Risk Management Committee,
described below, reviews our PPP at least annually to assure continuing relevance and effectiveness.
● We maintain a dedicated, fully staffed and qualified Information Security team that reports to the office of the Chief Technology
Officer (CTO) and is currently led by the Director of Information Security (InfoSec). Combined, these individuals have more than 50 years
of experience related to corporate information security governance, data and network security, data governance, risk management, and overall
secure practices involved with InfoSec.
● We have implemented a risk management process and formed a Risk Management Committee, which consists of members of our management
team, including members with technical expertise, to identify, evaluate and categorize any potential InfoSec risks.
● We perform vulnerability testing and penetration testing at routine intervals to assure that our InfoSec posture remains vigilant.
● We utilize and maintain third-party security vendors, as necessary, to provide assistance with a variety of security efforts.
● We are reviewing our security training protocols to ensure all employees received annual security training for all employees. This
security training will be focused on overall InfoSec, privacy best practices, and review of company policies.
● We have formed and maintain a 24/7 Security Operations Center (SOC)/Network Operations Center (NOC) that continually monitors our
key systems and logs.
● We have an incident response and escalation process that is designed to detect cyber incidents and react in an appropriate manner
to reduce any related damage.
● We conduct tabletop exercises related to business continuity planning and disaster recovery, as well as incident responses for our
SOC/NOC Operations team
● Our Board is regularly updated regarding the current state of InfoSec, its future roadmap, and any significant or material cybersecurity
incidents.
Cybersecurity Governance
Our Board actively oversees
our risk management activities and considers various risk topics throughout the year, including cybersecurity and information security
risk management and controls. As part of its oversight function, the Board oversees the Company’s risk assessment and risk management
policies, including related to cybersecurity and the data protection program, and performs an annual review and assessment of the primary
operational and regulatory risks facing the Company, their relative magnitude and management’s plan for mitigating these risks.
As appropriate, our CTO and
Director of InfoSec report to the Board on a broad range of topics, including any significant cybersecurity risks, the status of ongoing
projects, future roadmap planning, updates to the company’s PPP, and other relevant updates to our InfoSec operations and stance.
In addition, our Incident Response process is designed to ensure that the Board receives timely notifications and reports, particularly
with respect to any material cybersecurity incident , so that they are aware of any material incident and can provide oversight and direction
as part of the response and remediation process.
36
Our senior management is responsible
for assessing and managing the Company’s various exposures to risk, including those related to cybersecurity, on a day-to-day basis,
including the identification of risks through an enterprise risk management framework and the creation of appropriate risk management
programs and policies to address such risks. Our Risk Management Committee is responsible for assessing and categorizing any significant
identifiable risks and presenting them to senior management in a timely manner along with recommendations on how to manage these identified
risks. All potential risks are identified, quantified, and categorized in such a manner that they can be ranked and presented to senior
management for appropriate disposition (such as avoidance, acceptance, mitigation, etc.). Our CTO and Director of InfoSec have the primary
responsibility for managing our cybersecurity program and efforts. We perform internal audits of our internal information technology controls
and implementation, and we carry out a tabletop exercise at least once each year to determine our ability to respond to cybersecurity
incidents in an effective and efficient manner.
Our information technology
team have decades of operational experience both in private as well as classified government settings, advanced degrees in the information
technology field from accredited universities, certifications within their areas of expertise (e.g., Certified Information Systems Security
Professional (CISSP), Operating Systems Certifications, Network Engineering certifications, etc.).