Risk Management and Strategy

We maintain a technology and cybersecurity program, which includes information security, as part of our overall risk management process with the aim that our information systems, including those of our suppliers and other third-parties, will be resilient, effective and capable of safeguarding against emerging risks and cybersecurity threats. We endeavor to assure our program is appropriately resourced and to attract and retain expert talent to execute it.

We have established preventive measures and fulfill our security obligations to protect our networks from interference, damage, or unauthorized access, and to prevent the leakage, theft, or alteration of network data. As part of our supplier risk management program, we conduct security assessments prior to engagement of high-risk suppliers and other third-party providers and have a monitoring program to evaluate ongoing compliance with our cybersecurity standards.

A key element of our technology and cybersecurity program strategy is fostering training and awareness. Our training and awareness program includes annual cybersecurity awareness training and role-based phishing tests for our employees and for third parties with access to our systems.

Our technology and cybersecurity program focuses on the defense, rapid detection and rapid remediation of cybersecurity threats and incidents. Additionally, our program incorporates comprehensive cybersecurity policies and crisis response and management procedures, aimed at rapidly addressing, responding to, and effectively communicating about cybersecurity threats and incident.

Our cybersecurity crisis management program sets forth the items, procedures and actions we expect to address and follow in the event of a cybersecurity incident, including detection, response, mitigation and remediation. When a potential threat or incident is identified, our cyber security incident response team will assign a risk level classification and initiate the escalation and other steps called for by our plan. All incidents that are initially assessed by the cybersecurity incident response team as potentially high-risk are escalated promptly to our Chief Executive Officer, who will determine whether and what elements of our cybersecurity crisis response and management plan should be activated, including escalation to other senior management. Our Chief Executive Officer will inform our board of directors of cybersecurity incidents, as appropriate, considering a variety of factors, including financial, operational, legal or reputational impact.

Our program’s maturity and operational readiness are regularly evaluated by independent experts and penetration tests that are consistent with the national cybersecurity level. Our program, and the results of these independent evaluations and testing, are regularly reviewed by our senior management and members of our board of directors.

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

Risk Governance

We are committed to appropriate cybersecurity governance and oversight.

Our board of directors has oversight of our strategic and business risk management, including cybersecurity risk management. Our board of directors is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors.