Disclosure · Form 10-K · fiscal 2025
Paysign, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 25, 2026· period ended December 31, 2025· PAYS· CIK 1496443· Updated · filing on sec.gov ↗
Paysign, Inc.'s Form 10-K for fiscal 2025, filed March 25, 2026, names the Information Security Officer as its top security role, with oversight by the Audit Committee.
What Paysign's Item 1C says
Paysign's Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Board, in coordination with the Audit Committee. The filing says the Chief Technology Officer, Information Security Officer, and General Counsel have primary responsibility for assessing and managing material cybersecurity risks.
Board and management oversight
The Board and the Audit Committee receive regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Audit Committee directly oversees the cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk from risk assessments, risk reduction progress, external auditor feedback, control maturity assessments, and internal and industry incidents. The Board receives quarterly cybersecurity briefings, including key risk indicators, remediation metrics, third party risk insights, and updates on threats. The Security Committee meets at least quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies. The Security Committee is responsible for a cybersecurity risk report which is presented to the Board at each quarterly meeting.
Who leads security
The Chief Technology Officer, Information Security Officer, and General Counsel are members of the management Information Technology Steering Committee, which drives alignment on security decisions across the company. These individuals have experience in various roles for public companies involving managing information security, managing risk, implementing information and cybersecurity programs, and adhering to compliance requirements.
How the company manages cyber risk
The company's controls are designed in alignment with the NIST Cybersecurity Framework and incorporate key principles of ISO 27001. The company conducts annual penetration and segmentation testing and periodic threat hunting exercises. The company's incident response program includes ransomware specific playbooks and cross functional tabletop exercises involving senior leadership. The company conducts periodic phishing simulations and tracks cybersecurity awareness metrics as part of its overall risk management dashboard.
Third parties and incidents
Semi-annually, the company uses third-party independent consultants to perform penetration and segmentation testing of its internal and externally facing environments. The company has a Vendor Risk Management Program to monitor cybersecurity risks posed by third-party vendors and service providers. The company says it is not aware of risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect its business strategy, results of operations, or financial condition.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed March 25, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Information Security Officer
Reports to
not identified
Board oversight
Audit Committee
“Our Audit Committee directly oversees our cybersecurity program.”
How often the board or committee hears about it
Quarterly
“The Board receives quarterly cybersecurity briefings, including key risk indicators, remediation”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework, ISO/IEC 27001
Where the filing names them
- NIST Cybersecurity Framework: “NIST Cybersecurity Framework and incorporate key principles of ISO 27001.”
- ISO/IEC 27001: “NIST Cybersecurity Framework and incorporate key principles of ISO 27001.”
Outside assessors, consultants or testers
Described
“Semi-annually, we leverage third-party independent consultants to perform”
Experience of the security leadership, as stated
Stated
“Such individuals have experience in various roles for public companies involving managing information security, managing risk, implementing effective information and cybersecurity programs, and adhering to relevant compliance requirements.”
Material incident
The filing states none
“We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.”
The section
1,344 words, Form 10-K filed March 25, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 29, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Paysign, Inc. standard industrial classification 7389, Services-business services, nec (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| AccentureFY 2026, filed October 16, 2026 | chief information security officer | General Counsel | Audit Committee of the Board of Directors |
| Sparta Commercial Services, Inc.FY 2026, filed August 13, 2026 | Vice President Operations | Chief Executive Officer or the board, as appropriate | not identified |
| CBIZ, Inc.FY 2025, filed August 4, 2026 | Vice President, IT Security and Compliance | Chief Information Officer | full board |
| Two Hands CorpFY 2025, filed April 10, 2026 | not identified | not identified | full board |
| Quotemedia IncFY 2025, filed April 7, 2026 | not identified | not identified | Audit Committee |
| Datavault AI Inc.FY 2025, filed March 18, 2026 | not identified | not identified | Audit Committee |
| Heritage Global Inc.FY 2025, filed March 12, 2026 | not identified | not identified | Corporate Governance Committee |
| RB Global Inc.FY 2025, filed February 25, 2026 | Chief Information Security Officer | not identified | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Paysign, Inc.'s Form 10-K as filed with the SEC on March 25, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY.
Risk Management and Strategy
Cyber criminals are becoming more
sophisticated and effective every day, and they are increasingly targeting software companies, including companies like ours that
handle sensitive customer and stakeholder data. All companies utilizing technology are subject to threats of breaches of their
cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management
and make securing the data that customers and other stakeholders entrust to us a top priority. Our Board and our management are
actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As
described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and
managing material risks from cybersecurity threats. We have devoted financial and personnel resources to implement and maintain
security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant
investments to maintain the security of our data and cybersecurity infrastructure. While no cybersecurity program can eliminate all
risk or guarantee complete effectiveness, our controls are designed in alignment with industry recognized frameworks such as the
NIST Cybersecurity Framework and incorporate key principles of ISO 27001.
While our Risk Factors describe in greater detail the material cybersecurity
risks we face, we believe that prior cybersecurity threats, including any previous cybersecurity incidents, have not materially impacted
our business to date. However, we cannot guarantee that future incidents will not occur or that, if they do, they will not have a material
adverse effect on our business, strategy, results of operations, or financial condition.
Risk Management and Strategy
We understand the critical importance of cybersecurity
in protecting our operations, customer data, and the integrity of our services. Our commitment to cybersecurity is unwavering, and we
adopt a serious, multi-layered approach to minimize the risks and potential impacts of cyber-attacks which has been integrated into our
overall risk management process. Our cybersecurity controls are guided by a formal data classification policy and are supported by a maturing
Zero Trust–inspired architecture, which includes least privilege access, continuous authentication and micro segmentation.
Our strategies are designed to ensure the resilience
and security of our systems, safeguarding against both internal and external vulnerabilities. We employ state-of-the-art technologies
and practices to secure our systems. This includes deploying advanced encryption, securing network infrastructure, and implementing robust
access controls and authentication mechanisms. Our information technology infrastructure is designed with security at its core, incorporating
full encryption of data in transit and at rest, endpoint detection and response, security information and event management
correlation, continuous vulnerability scanning and commercial threat intelligence feeds monitored by our 24/7/365 Security Operations
Center.
As part of our risk assessment framework, we have
a Vendor Risk Management Program to monitor cybersecurity risks posed by third-party vendors and service providers. This program
includes:
·
Vendor Onboarding and Due Diligence: New vendors undergo security assessments to evaluate their data protection measures, regulatory compliance and cybersecurity policies.
·
Ongoing Monitoring and
Risk Assessments: We conduct periodic reviews of vendor security practices which may include security questionnaires, risk scoring,
and audits for high-risk vendors.
·
Contractual Security Obligations: Vendor agreements include strict data security clauses, incident notification requirements and audit rights.
·
Incident Reporting and Escalation: We have clear protocols for reporting vendor-related cybersecurity incidents, ensuring timely response and mitigation.
·
Vendors are risk tiered
based on criticality, and high-risk vendors undergo enhanced due diligence activities, including review of System and Organization Controls
reports, penetration test summaries and continuous monitoring signals where available.
Partnerships and Collaboration
We believe in the strength of collaboration in
combating cyber threats. We actively engage with cybersecurity communities, industry groups, and regulatory bodies to stay ahead of evolving
cyber risks. We also participate in threat sharing programs and use horizon scanning activities to evaluate emerging risks that may impact
fintech, payments infrastructure, and healthcare related data environments. By sharing knowledge and best practices, we enhance our defenses
and contribute to the broader effort of securing the digital ecosystem. We maintain controls and procedures that are designed to ensure
prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can
be made by management and the Board in a timely manner.
Risk Assessment
We continuously monitor our information technology
environment to detect and respond to threats in real-time. Our dedicated cybersecurity team uses sophisticated tools to track anomalies,
potential vulnerabilities, and ongoing attacks. In addition to annual penetration and segmentation testing, we conduct periodic threat
hunting exercises to proactively identify malicious activity. Semi-annually, we leverage third-party independent consultants to perform
penetration and segmentation testing of our internal and externally facing environments. Results from these assessments inform remediation
roadmaps, prioritization of security investments, and updates to our enterprise risk register.
Technical Safeguards
Cybersecurity is an ever-evolving field, and we
are committed to continuous improvement of our security practices. We regularly review and update our cybersecurity policies, procedures,
and technologies to address new challenges and adapt to the changing threat landscape. Technical safeguards also include multi factor
authentication (MFA) across all privileged and non-privileged accounts, automated provisioning and de provisioning, periodic access reviews,
and comprehensive logging and monitoring to support audit and regulatory obligations.
Incident Response and Recovery Planning
Cybersecurity is a foundational element of our
operations. Our multi-layered approach—encompassing system security, vigilant monitoring, comprehensive training, and collaborative
engagement—demonstrates our dedication to protecting our company, our clients, and the financial ecosystem. Our incident response
program includes ransomware specific playbooks, cross functional tabletop exercises involving senior leadership, and tight integration
with our business continuity (BCP) and disaster recovery (DR) plans. We have established comprehensive incident response and recovery
plans and continue to regularly test and evaluate the effectiveness of those plans.
Education and Awareness
Recognizing that human error can often be a weak
link in cybersecurity defenses, we are committed to regular and comprehensive training for all employees and executives. We also conduct
periodic phishing simulations, evaluate key performance indicators such as employee susceptibility rates, and track cybersecurity awareness
metrics as part of our overall risk management dashboard.
Cybersecurity Threats
We are not aware of any risks from cybersecurity
threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially
affect our business strategy, results of operations, or financial condition.
Governance
Board Oversight
Our Board, in coordination with the Audit Committee,
oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation,
and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Audit Committee
directly oversees our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting
from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal
and industry cybersecurity incidents. The Board receives quarterly cybersecurity briefings, including key risk indicators, remediation
metrics, third party risk insights, and updates to our threat landscape assessment.
Management's Role
Our Chief Technology Officer, Information Security Officer, and General
Counsel have primary responsibility for assessing and managing material cybersecurity risks and are members of our management's
Information Technology Steering Committee (the "Security Committee"), which is a governing body that drives alignment on security
decisions across the Company. Such individuals have experience in various roles for public companies involving managing information security,
managing risk, implementing effective information and cybersecurity programs, and adhering to relevant compliance requirements. The Security
Committee meets at least quarterly to review security performance metrics, identify security risks, and assess the status of approved
security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service
requirements, and risk mitigation strategies. The Security Committee is responsible for a cybersecurity risk report which is presented
to the Board at each quarterly meeting, ensuring continuous oversight of cybersecurity risks and mitigation efforts at the highest
levels of governance. Management evaluates the cybersecurity program using defined key risk indicators, including patch timeliness
metrics, vulnerability severity reduction intervals, access review completion rates, phishing resilience metrics and third party assurance
results.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 26, 2025 sec.gov ↗
Top security role, as the filing names it
Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Audit Committee directly oversees our cybersecurity program.”
Person named in the filing
not identified
Experience, as stated
Stated
“Such individuals have experience in various roles for public companies involving managing information security, managing risk, implementing effective information and cybersecurity programs, and adhering to relevant compliance requirements.”
Material incident
The filing states none
“We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 29, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY.
Risk Management and Strategy
Cyber criminals are becoming more sophisticated
and effective every day, and they are increasingly targeting software companies. All companies utilizing technology are subject to
threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity
risk management and make securing the data customers and other stakeholders entrust to us a top priority. Our Board and our management
are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described
in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material
risks from cybersecurity threats. We have devoted financial and personnel resources to implement and maintain security measures to meet
regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security
of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in
every instance or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material
cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity
incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future
or that they will not materially affect us, including our business strategy, results of operations, or financial condition.
Risk Management and Strategy
We understand the critical importance of cybersecurity
in protecting our operations, customer data, and the integrity of our services. Our commitment to cybersecurity is unwavering, and we
adopt a serious, multi-layered approach to minimize the risks and potential impacts of cyber-attacks which has been integrated into our
overall risk management process. Our strategies are designed to ensure the resilience and security of our systems, safeguarding against
both internal and external vulnerabilities. We employ state-of-the-art technologies and practices to secure our systems. This includes
deploying advanced encryption, securing network infrastructure, and implementing robust access controls and authentication mechanisms.
While we can provide no assurance against unauthorized access and breaches, our information technology infrastructure is designed with
security at its core, with all data, whether at rest or in transit, being protected against unauthorized access and breaches.
As part of our risk assessment framework, we have a Vendor Risk
Management Program to monitor cybersecurity risks posed by third-party vendors and service providers. This program includes:
· Vendor Onboarding and Due Diligence: New vendors undergo security assessments to evaluate their data
protection measures, regulatory compliance, and cybersecurity policies.
· Ongoing Monitoring and Risk Assessments: We conduct periodic reviews of vendor security
practices which may include security questionnaires, risk scoring, and audits for high-risk vendors.
· Contractual
Security Obligations: Vendor agreements include strict data security clauses, incident notification requirements, and audit rights.
· Incident
Reporting and Escalation: We have clear protocols for reporting vendor-related cybersecurity incidents, ensuring timely response
and mitigation.
Partnerships and Collaboration
We believe in the strength of collaboration in
combating cyber threats. We actively engage with cybersecurity communities, industry groups, and regulatory bodies to stay ahead of evolving
cyber risks. By sharing knowledge and best practices, we enhance our defenses and contribute to the broader effort of securing the digital
ecosystem. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that
decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.
Risk Assessment
We continuously monitor our information technology
environment to detect and respond to threats in real-time. Our dedicated cybersecurity team uses sophisticated tools to track anomalies,
potential vulnerabilities, and ongoing attacks. This includes leveraging a best-in-class third-party 24/7/365 Security Operations Center.
This proactive surveillance allows us to address threats swiftly, mitigating any possible impact on our operations and clients. Semi-annually,
we leverage third-party independent consultants to perform penetration and segmentation testing of our internal and externally facing
environments. The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security
controls, make recommendations to improve processes, and inform a broader risk assessment that is presented to our Board, Audit Committee,
and members of management.
Technical Safeguards
Cybersecurity is an ever-evolving field, and we
are committed to continuous improvement of our security practices. We regularly review and update our cybersecurity policies, procedures,
and technologies to address new challenges and adapt to the changing threat landscape.
Incident Response and Recovery Planning
Cybersecurity is a foundational element of our
operations. Our multi-layered approach—encompassing system security, vigilant monitoring, comprehensive training, and collaborative
engagement—demonstrates our dedication to protecting our company, our clients, and the financial ecosystem. We remain steadfast
in our commitment to maintaining the highest standards of cybersecurity resilience and response. We have established comprehensive incident
response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery
plans address and guide our employees, management and the Board on our response to a cybersecurity incident.
Education and Awareness
Recognizing that human error can often be a weak
link in cybersecurity defenses, we are committed to regular and comprehensive training for all employees and executives. This includes
annual cybersecurity awareness sessions for our Board, ensuring that our highest levels of leadership are informed and vigilant about
the latest cybersecurity trends and threats. Our training programs are designed to foster a culture of security awareness, equipping our
team with the knowledge and tools needed to recognize and prevent cyber threats.
Cybersecurity Threats
We are not aware of any risks from cybersecurity
threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially
affect, our business strategy, results of operations, or financial condition.
Governance
Board Oversight
Our Board, in coordination with the Audit Committee,
oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation,
and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Audit Committee
directly oversees our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting
from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal
and industry cybersecurity incidents.
Management's Role
Our Chief Technology Officer, Information Security
Officer, and General Counsel have primary responsibility for assessing and managing material cybersecurity risks and are members of our
management's Information Technology Steering Committee (the "Security Committee"), which is a governing body that drives
alignment on security decisions across the Company. Such individuals have experience in various roles for public companies involving managing
information security, managing risk, implementing effective information and cybersecurity programs, and adhering to relevant compliance
requirements. The Security Committee meets at least quarterly to review security performance metrics, identify security risks, and assess
the status of approved security enhancements. The Security Committee also considers and makes recommendations on security policies and
procedures, security service requirements, and risk mitigation strategies. The Security Committee is responsible for a cybersecurity
risk report which is presented to the Board at each quarterly meeting, ensuring continuous oversight of cybersecurity
risks and mitigation efforts at the highest levels of governance
Fiscal 2023 Form 10-K, filed March 27, 2024 sec.gov ↗
Top security role, as the filing names it
Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Audit Committee directly oversees our cybersecurity program.”
Person named in the filing
not identified
Experience, as stated
Stated
“Such individuals have experience in various roles for public companies involving managing information security, managing risk, implementing effective information and cybersecurity programs, and adhering to relevant compliance requirements.”
Material incident
The filing states none
“We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 29, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY.
Cyber criminals are becoming more sophisticated
and effective every day, and they are increasingly targeting software companies. All companies utilizing technology are subject to
threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity
risk management and make securing the data customers and other stakeholders entrust to us a top priority. Our Board and our management
are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described
in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material
risks from cybersecurity threats. We have devoted financial and personnel resources to implement and maintain security measures to meet
regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security
of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in
every instance or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material
cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity
incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future
or that they will not materially affect us, including our business strategy, results of operations, or financial condition.
Risk Management and Strategy
We understand the critical importance of cybersecurity
in protecting our operations, customer data, and the integrity of our services. Our commitment to cybersecurity is unwavering, and we
adopt a serious, multi-layered approach to minimize the risks and potential impacts of cyber-attacks which has been integrated into our
overall risk management process. Our strategies are designed to ensure the resilience and security of our systems, safeguarding against
both internal and external vulnerabilities. We employ state-of-the-art technologies and practices to secure our systems. This includes
deploying advanced encryption, securing network infrastructure, and implementing robust access controls and authentication mechanisms.
While we can provide no assurance against unauthorized access and breaches, our information technology infrastructure is designed with
security at its core, with all data, whether at rest or in transit, being protected against unauthorized access and breaches.
Partnerships and Collaboration
We believe in the strength of collaboration in
combating cyber threats. We actively engage with cybersecurity communities, industry groups, and regulatory bodies to stay ahead of evolving
cyber risks. By sharing knowledge and best practices, we enhance our defenses and contribute to the broader effort of securing the digital
ecosystem. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that
decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.
Risk Assessment
We continuously monitor our information technology
environment to detect and respond to threats in real-time. Our dedicated cybersecurity team uses sophisticated tools to track anomalies,
potential vulnerabilities, and ongoing attacks. This includes leveraging a best-in-class third-party 24/7/365 Security Operations Center.
This proactive surveillance allows us to address threats swiftly, mitigating any possible impact on our operations and clients. Semi-annually,
we leverage third-party independent consultants to perform penetration and segmentation testing of our internal and externally facing
environments. The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security
controls, make recommendations to improve processes, and inform a broader risk assessment that is presented to our Board, Audit Committee,
and members of management.
Technical Safeguards
Cybersecurity is an ever-evolving field, and we
are committed to continuous improvement of our security practices. We regularly review and update our cybersecurity policies, procedures,
and technologies to address new challenges and adapt to the changing threat landscape.
Incident Response and Recovery Planning
Cybersecurity
is a foundational element of our operations. Our multi-layered approach — encompassing
system security, vigilant monitoring, comprehensive training, and collaborative engagement — demonstrates
our dedication to protecting our company, our clients, and the financial ecosystem. We remain steadfast in our commitment to maintaining
the highest standards of cybersecurity resilience and response. We have established comprehensive incident response and recovery plans
and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide
our employees, management and the Board on our response to a cybersecurity incident.
Education and Awareness
Recognizing that human error can often be a weak
link in cybersecurity defenses, we are committed to regular and comprehensive training for all employees and executives. This includes
annual cybersecurity awareness sessions for our Board, ensuring that our highest levels of leadership are informed and vigilant about
the latest cybersecurity trends and threats. Our training programs are designed to foster a culture of security awareness, equipping our
team with the knowledge and tools needed to recognize and prevent cyber threats.
Cybersecurity Threats
We are not aware of any risks from cybersecurity
threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially
affect, our business strategy, results of operations, or financial condition.
Governance
Board Oversight
Our Board, in coordination with the Audit Committee,
oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation,
and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Audit Committee
directly oversees our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting
from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal
and industry cybersecurity incidents.
Management's Role
Our Chief Technology Officer, Information Security
Officer, and General Counsel have primary responsibility for assessing and managing material cybersecurity risks and are members of our
management's Information Technology Steering Committee (the "Security Committee"), which is a governing body that drives
alignment on security decisions across the Company. Such individuals have experience in various roles for public companies
involving managing information security, managing risk, implementing effective information and cybersecurity programs, and adhering to
relevant compliance requirements. The Security Committee meets at least quarterly to review security performance metrics,
identify security risks, and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations
on security policies and procedures, security service requirements, and risk mitigation strategies.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.