Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
RISK MANAGEMENT AND STRATEGY
Our cybersecurity program works to address, identify, and mitigate the material risk that may arise from a cybersecurity threat. Our goal is to continually assess the current known risks and work towards both predicting and combating future risks that may arise in our business and the industry at large. As discussed below, we employ a range of mitigation strategies that aid us in protecting our customers from cybersecurity risks.
24
Table of Contents
As part of the Company’s overall risk mitigation strategy, the Company has policies, controls, and procedures in place for assessing, identifying, and managing material risks from cybersecurity threats, including, but not limited to:
• Reviewing financial reporting systems and subsystems to ensure that access is limited to approved users;
• Reviewing data recorded, processed, and reported to ensure that the data remains complete, accurate, and valid;
• Conducting regular network and endpoint monitoring and vulnerability assessments to improve our information systems;
• Reviewing system changes of financial reporting significance to ensure that they have been authorized and appropriately tested before being moved to production;
• Monitoring and identifying cybersecurity threats in connection with the use of third-party providers;
• Responding to and remediating any incident of damage or interruption to our information technology systems, including cyberattacks, internally and through the use of third-party providers as necessary;
• Carrying information security risk insurance that provides protection against potential losses arising from a cybersecurity incident; and
• Requiring regular cybersecurity training programs for employees, management, and directors.
GOVERNANCE
The Company’s Board of Directors and management have regular discussions related to cyber risks and exposures, risk management and mitigation strategy, monitoring, and cyber-incident response and recovery plans. Members of the Board of Directors have access to, and relationships with, cybersecurity experts in the organization, including the Company’s Head of Information Technology, who has extensive experience in network operations and cybersecurity. The Company’s Head of Information Technology reports to the Company’s Chief Financial Officer, who relays cyber-related information to the Board of Directors. Additionally, as the dynamic cybersecurity environment is continuously evolving, management has periodic meetings with our cybersecurity insurance providers to reevaluate the Company’s cybersecurity risks and related information technology resiliency. The Board of Directors is informed of any material information technology breaches that the Company has experienced in a timely manner.