Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
Globally, organizations are encountering cybersecurity incidents with growing frequency, and the nature of these threats, including through the use of AI, is becoming more sophisticated and constantly changing. We recognize the importance of developing, implementing and maintaining strong cybersecurity policies and processes to protect our information systems and the confidentiality, integrity and accessibility and availability of our data.
Risk Management and Strategy
We have developed and maintained policies, procedures and controls that seek to assess, identify and manage material risks from cybersecurity threats, and assess and disclose information to investors concerning material cybersecurity incidents. Further, we have strategically integrated cybersecurity risk management into our broader risk management framework to promote awareness and attention to cybersecurity risk management across our business. These risks are evaluated on an ongoing basis as part of our overall risk management strategy that is generally overseen by the Audit Committee (the “ Audit Committee ”) of our Board of Directors (the “ Board ”). Our Chief Executive Officer and our Chief Financial Officer oversee the details of our information security risk management approach. Under the direction of our Chief Financial Officer, our lead IT manager (the “ IT Manager ”) evaluates the effectiveness of the data and information systems in protecting our data and information systems from security threats. The evaluation stratifies IT systems based on the risk and severity of potential security breaches related to the data handled and assesses the effectiveness of the systems in safeguarding against cyber threats. The evaluation reviews, among other things, physical security, network security, host security, application security, data security and AI usage. Our Security Operations Center, which consists of a team provided by our third party managed service provider, continuously monitors for security events and threats, responding and escalating when appropriate.
All of our employees, consultants and contractors are encouraged to exercise professional judgement in using computing devices and network resources connected to the information technology network and infrastructure, and are strictly prohibited from certain acts enumerated in our cybersecurity policy including, among other things, accessing such devices or resources for non-business purposes, disabling our security features and requirements and exporting information or technologies without consent and password sharing. Violations or breaches of our cybersecurity policy or the associated schedules, standards or guidelines may result in suspension and/or discipline up to and including termination, in addition to administrative sanctions or legal actions.
Despite these efforts, no system is impenetrable. In addition, new technology that could result in greater operational efficiency such as use of AI may further expose our operations and computer systems to risk of cybersecurity incidents. We cannot provide assurances that we will prevent every attack or timely detect every incident.
Engagement of Third Parties for Cybersecurity Risk Management
When appropriate, we use external subject matter specialists, including assessors, consultants or other third parties, to assess our cybersecurity risk management processes. We will consider resource and capital constraints when determining the nature and timing of enhancing our cybersecurity infrastructure.
Overseeing Risks Stemming from Third-Party Service Providers
We maintain comprehensive internal protocols to mitigate cybersecurity threats associated with our use of third -party service providers. We have engaged third parties that supply IT services or have access to our systems or data to adhere to our security policies. These third parties provide detailed information on their established security controls via our risk assessment process. Specific certification may be required of critical third -party IT service providers. We are currently enhancing these protocols to further strengthen our defenses and reduce potential vulnerabilities.
31
Table of Contents
Material Risks from Cybersecurity Threats
We are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cybersecurity threat would not materially affect our business strategy, results of operations or financial condition. See “ We are dependent on information technology systems, which are subject to certain risks, including cybersecurity risks and data leakage risks associated with implementation and integration ” in “Item 1A. Risk Factors” in this Annual Report.
Governance
Board of Directors Oversight
Our Board recognizes the importance of information security and mitigating cybersecurity and other data security threats and risks as part of our efforts to protect and maintain the confidentiality and security of our employees, service providers, consultants and business associates, as well as non-public information about us. Although our Board has ultimate responsibility with respect to risk management oversight, the Audit Committee is charged with and bears primary responsibility for, among other matters, overseeing risks specific to the identification and mitigation of cybersecurity threats. The Audit Committee is informed of the status of our cybersecurity risk management processes by management at least annually, and more frequently as needed. These briefings encompass a broad range of topics, including:
●
current cybersecurity landscape and emerging threats;
●
the status of ongoing cybersecurity initiatives, strategies, and best practices; and
●
incident reports and learnings from any cybersecurity events.
Management ’ s Role in Managing Risk
Our Chief Executive Officer and Chief Financial Officer oversee the details of our information security risk management approach and may appoint team leads from various departments from time to time to assist with certain aspects of our cybersecurity risk mitigation strategy.
Our IT Manager , under the direction of our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The IT Manager has approximately eight years of experience in corporate IT management, cybersecurity and digital transformations. The IT Manager is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through management of and participation in the cybersecurity risk management processes described above, and regularly reports to our Chief Financial Officer. Our Chief Financial Officer will immediately notify the Audit Committee and the Board of any cybersecurity incident that is determined to be material. Our Chief Financial Officer delivers updates to the Audit Committee and to the Board annually, or more frequently as needed, in response to specific incidents or emerging threats.
As we progress in the assessment and enhancement of our cybersecurity program, we plan to consider the following areas for enhancement and incorporation into the cybersecurity risk management and governance program in the future:
●
oversight of third -party cybersecurity risk;
●
engaging/outsourcing risk management personnel;
●
monitoring system/procedures for cybersecurity incidents; and
●
reporting to the Board regarding cybersecurity risks and incidents.
32
Table of Contents