Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS.
None.
ITEM 1C. CYBERSECURITY.
Cybersecurity Risk Management and Strategy
We have developed and implemented, and continue
to implement, cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical
systems and information. Primary cybersecurity oversight responsibility is shared by our board of directors, our audit and compliance
committee (“Audit Committee”), and senior management.
Our cybersecurity risk management program includes
physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections
designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and
other third-party information stored on those systems. These measures include access controls, encryption, data handling requirements,
and internal policies that govern our cybersecurity risk management and data protection practices. Our program also includes cybersecurity
risk assessment processes designed to help identify material cybersecurity risks to our critical systems and information.
Over the past fiscal year, we have not identified
risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations,
business strategy, operating results, or financial condition.
We will continue to monitor and assess our cybersecurity
risk management program as well as seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity
incident in the future, such incident may have a material effect, including on our operations, business strategy, operating results, or
financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto,
see the section titled “ Risk Factors ” in Part I, Item 1A of this Report.
Cybersecurity Governance
With oversight from our board of directors, the
Audit Committee is primarily responsible for assisting the board in fulfilling its oversight responsibilities relating to risk assessment
and management, including cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation
of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management’s
strategies for adequately mitigating and managing identified risks relating to cybersecurity threats.
54
The Audit Committee receives updates from members
of management on our cybersecurity risks at its quarterly meetings, and reviews metrics about cyber threat response preparedness, program
maturity, risk mitigation status, and the current and emerging threat landscape. In addition, management provides updates to the Audit
Committee, as necessary, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.
The Audit Committee reports to our board of directors
regarding its activities, including those related to key cybersecurity risks, mitigation strategies, and ongoing developments, on a quarterly
basis, or more frequently as needed. The board of directors also receives updates from management on our cyber risk management program
and other matters relating to our data privacy and cybersecurity approach, including risk mitigations to bolster and enhance our data
protection and data governance framework.
Our management team is responsible for assessing
and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis.
Our management team supervises our efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various
means, including through briefings from internal IT personnel, which may include threat intelligence and other information obtained from
governmental, public or private sources, and alerts and reports produced by security tools deployed in our IT environment.