SurgePays, Inc. 10-K Cybersecurity GRC - 2024-03-12

Page last updated on July 16, 2024

SurgePays, Inc. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-12 16:05:49 EDT.

Filings

10-K filed on 2024-03-12

SurgePays, Inc. filed a 10-K at 2024-03-12 16:05:49 EDT
Accession Number: 0001493152-24-009661

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBERSECURITY Cybersecurity Risk Management and Strategy We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities. 10 Our cybersecurity risk management methodology includes: ● risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; ● individuals, including employees and external third-party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; ● the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; ● cybersecurity awareness training of our employees, incident response personnel, and senior management; ● a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and ● a third-party risk management process for service providers, suppliers, and vendors. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Cybersecurity Governance Our Board provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. The Board has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation of our cybersecurity risk management methodology. Our Board and the Audit Committee receives periodic updates from our Chief Financial Officer and more frequently as needed, regarding the overall state of our cybersecurity preparedness, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents. The Audit Committee and our management team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel. The Audit Committee reports to the full Board regarding cybersecurity activities. The full Board also receives briefings from management on cyber risk issues and best practices. Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for developing and maintaining our overall cybersecurity risk methodology and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

Company Information