Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS .
Not applicable.
ITEM 1C. CYBERSECURITY .
Risk Management and Strategy .
We have implemented and maintain various information security processes designed to identify, assess and manage material risks arising from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data — including intellectual property and confidential information that is proprietary, strategic or competitive in nature (collectively, our “Information Systems and Data”).
Our cross-functional cybersecurity risk management team, led by our Chief Financial Officer (“CFO”) and our Vice President of Manufacturing, helps identify, assess, and manage our cybersecurity threats and risks. The team monitors and evaluates our threat environment using a variety of methods including manual and automated security tools, subscription-based threat intelligence reports and services, threat environment scans, evaluation of our company’s and our industry’s risk profile, formal threat assessments, and vulnerability assessments.
Based on the specific risk environment, we implement and maintain technical, physical, and organizational safeguards designed to manage and mitigate material cybersecurity risks to our Information Systems and Data. These safeguards include, among other measures, incident detection and response capabilities; risk assessments; implementation of defined security standards; data encryption; network security controls; data segmentation; access controls; asset management and secure disposal procedures; continuous systems monitoring; employee cybersecurity training; physical security controls; and cyber insurance coverage.
Our cybersecurity risk assessment and management activities are integrated into our broader enterprise risk management framework. Management evaluates material cybersecurity risks in the context of our overall business objectives and periodically reports to the board of directors, which oversees our overall enterprise-wide risk profile.
We engage third-party service providers to perform a variety of cybersecurity functions across our business, including managed cybersecurity service providers and dark web monitoring services. These providers assist us in identifying, assessing, and managing material risks arising from cybersecurity threats. We also use a variety of third party service providers, including application providers and hosting companies. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data involved, and the specific provider, our vendor management processes incorporate risk-based assessments designed to help identify and evaluate cybersecurity risks associated with such provider, and may include conducting cybersecurity-focused risk assessments.
For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K, including “ Privacy breaches and other cybersecurity risks related to our business and vulnerabilities through the use of evolving tools such as Artificial Intelligence could negatively affect our reputation, credibility, and business ”.
Governance .
Our board of directors addresses our cybersecurity risk management as part of its overall oversight responsibilities. The board of directors oversees our cybersecurity risk management framework, including the identification, assessment, and mitigation of risks arising from cybersecurity threats
Our cybersecurity risk assessment and management processes are implemented and maintained by a cross-functional management team comprised of our CFO and our Vice President of Manufacturing . This team is responsible for approving cybersecurity budgets, helping prepare for cybersecurity incidents, approving cybersecurity policies and procedures, and reviewing security assessments and related reports. The team also oversees the hiring of appropriate personnel, supports integrating cybersecurity risk considerations into our broader enterprise risk management strategy, and communicates key cybersecurity priorities to relevant personnel across the organization. Both have previous academic and professional experience in the field of cybersecurity.
Our cybersecurity incident response processes are designed to escalate certain incidents to members of management based on the nature and severity of the event. The CFO and Vice President of Manufacturing work with the incident response
26
Table of Contents
team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response framework provides for reporting certain cybersecurity incidents to our board of directors.
The board of directors receives periodic reports from our CFO regarding significant cyberse curity threats and risks, as well as the measures implemented to address them. The board of directors also has access to various reports, summaries, or presentations related to cybersecurity threats, risk management activities and mitigation efforts.
ITEM 2. PROPERTIES.
As of December 31, 2025, we lease and occupy approximately 17,000 square feet of space in Surprise, Arizona for our corporate, manufacturing and research operations pursuant to a lease that expires in May 2035.
We believe that our existing facilities are adequate and meet our current needs for business, manufacturing and research.