TherapeuticsMD, Inc. 10-K

Item 1B. Unresolved staff comments None. Item 1C. Cybersecurity Cybersecurity Risk Management and Strategy We have implemented and maintain various information security processes designed to assess, identify and manage material risks from cybersecurity threats to our critical systems and information. Such processes are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and has historically been included as part of compliance reports provided to our audit committee. 37 Our officers, contractors and third-party IT vendors help assess, identify and manage our cybersecurity threats and risks by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools; conducting audits and threat assessments for internal and external threats; analyzing reports of threats and actors; evaluating our and our industry’s risk profile; and evaluating threats reported to us. We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our critical systems and information, including, for example: multi-factor authentication, encryption, anti-malware functionality, access controls and systems monitoring. We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers and hosting companies. All of our critical information is hosted by a third-party service provider. Further, we also rely upon such third-party service providers to both assist us in identifying cybersecurity threats , as well as to review and notify us of any data breach on their systems. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this 2024 10-K Report, including the risk factor captioned “We may not be able to maintain effective and efficient information systems or properly safeguard our information systems.” While to date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner. We also carry cybersecurity insurance to protect the Company in the event of a cybersecurity breach and to provide resources if a cybersecurity breach occurs. Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function. The audit committee of our board of directors bears primary responsibility for the board’s oversight of our cybersecurity risk. Periodically management updates our audit committee about various risks facing the Company, of which cybersecurity may be included. Our cybersecurity risk assessment and management processes are implemented and maintained by management and IT consultants . The IT consultants have relevant expertise, experience, education and training as well as knowledge of our company’s critical systems and information technology policies. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to our chief executive officer , who would be responsible, along with third parties including our IT consultants, for assessing the materiality of, and mitigating and remediating, any cybersecurity incidents of which we are notified. In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors.