Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
We maintain a comprehensive cybersecurity program and process for identifying, assessing and managing risks from cybersecurity threats as part of our broader enterprise risk management system. Our cybersecurity program is run by a dedicated team of cybersecurity professionals with deep expertise in security best practices, security and system engineering, and incident response. Our Vice President, Information Security is a Certified Information Systems Security (CISSP) and Certified Information Security Management (CISM) professional with a degree in computer science and more than 30 years of relevant IT experience, including more than 10 years at the Company. The Information Security function reports to our Chief Operating Officer, who is a seasoned executive with a degree in industrial systems and decades of product and technology experience, including more than 20 years with the Company. The Information Security team is responsible for identifying, assessing and mitigating cybersecurity threats, risks, and vulnerabilities; evaluating and deploying appropriate security tools; and operating a 24x7 security operations center to promptly detect, contain, remediate and prevent security incidents. Security incidents are reported to a cross-functional working group that includes our Chief Operating Officer, General Counsel, Chief Compliance Officer and other stakeholders as merited.
We have aligned our information security management system to the International Organization for Standardization ("ISO") 27001 standard and our privacy management system to the ISO 27701 standard. An outside auditor tests the effectiveness of our security and privacy controls against the ISO 27001 and 27701 standards on an annual basis. We regularly update our program and processes to incorporate recommendations from auditors and outside security experts. We also maintain a third-party risk management process that includes the screening and evaluation of service providers against our security, privacy, and compliance standards.
Our Board of Directors has an active role, as a whole and at the committee level, in overseeing management of our material risks from cybersecurity threats. The Board's Audit Committee oversees management of financial, regulatory, compliance and security risks and receives reports at least quarterly from our Chief Operating Officer regarding our cybersecurity programs, vulnerabilities, threats and risks. The full Board is regularly informed about such risks through committee reports, attendance at committee meetings and other communications.
Our executive leadership team is responsible for designing and implementing our enterprise risk management program, with input from our Chief Product Officer, Chief Operating Officer, General Counsel and other security and privacy personnel regarding material risks from cybersecurity threats. The executive leadership team regularly discusses security threat trends, incident trends, risk mitigation, and overall security strategy as part of our enterprise security governance process. We consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management team informs our independent public accounting firm of any relevant developments.
We have experienced, and may in the future experience, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations or financial condition to date, and although our processes are designed to help prevent, detect, mitigate, and minimize the impact of such incidents, we cannot guarantee that a future security incident would not materially affect our strategy, results of operations or financial condition. For more information on our cybersecurity-related risks, see Item 1A , "Risk Factors" of this 10-K.