Organogenesis Holdings Inc. 10-K Cybersecurity GRC - 2024-02-29

Page last updated on July 16, 2024

Organogenesis Holdings Inc. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-02-29 16:31:04 EST.

Filings

10-K filed on 2024-02-29

Organogenesis Holdings Inc. filed a 10-K at 2024-02-29 16:31:04 EST
Accession Number: 0000950170-24-023150

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBERSECURITY Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and to address potential cybersecurity incidents that may materially affect our business. Our information security team manages and enhances our cybersecurity infrastructure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We utilize cybersecurity tools, including the Collective Controls Catalog, in assessing the threat landscape and continuously monitoring our environment. We face a number of cybersecurity risks in connection with our business. We have, from time to time, experienced threats to our data and systems, including malware and computer virus attacks. However, such risks and threats have not materially affected our business strategy, results of operations, or financial condition to date. Third-party service providers and consultants Cybersecurity partners are a key part of our cybersecurity infrastructure. We partner with cybersecurity companies and leverage their technology and expertise to better protect the Company. From time to time, we engage certain vendors to monitor our environment, which includes an outsourced security operations center. We may also from time to time engage partners for periodic penetration testing and vulnerability assessments. We intend to continue to work to formalize our cybersecurity program, including developing processes for third-party service provider cyber-risk oversight and management. Governance Our cybersecurity organization, led by our Assistant Vice President of IT and our Director of Information Security, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Within our team, our current Director of Information Security has professional cybersecurity certifications. The Company’s Board of Directors administers risk management oversight through the Audit Committee of the Board. Our Audit Committee receives quarterly updates about the effectiveness of the Company’s cybersecurity and information security programs, vulnerability and threat detection, progress relative to the Company’s cybersecurity roadmap, and the status of projects to strengthen our information security systems. The Audit Committee discusses with Company management and the Board the Company’s processes with respect to risk assessment and risk management.

Company Information