Heliogen, Inc. 10-K Cybersecurity GRC - 2024-03-26

Page last updated on July 16, 2024

Heliogen, Inc. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-26 16:23:26 EDT.

Filings

10-K filed on 2024-03-26

Heliogen, Inc. filed a 10-K at 2024-03-26 16:23:26 EDT
Accession Number: 0001840292-24-000010

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity Risk Management and Strategy We have implemented and maintain various information security processes and technologies designed to identify, assess and manage material risks from cybersecurity threats to our computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature (“Information Systems and Data”). Heliogen’s Chief Information Security Officer (“CISO”) and the information security team, in conjunction with Heliogen’s legal team and third-party service providers, help identify, assess and manage Heliogen’s cybersecurity threats and risks. Heliogen’s CISO and the information security team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods from time to time, including, for example: conducting vulnerability assessments to identify vulnerabilities; conducting scans of corporate devices and network infrastructure; analyzing reports of potential, known and identified threats and actors; using automated and manual tools to monitor for, identify, or evaluate threats and risks; conducting audits and threat assessments; subscribing to reports and services that help identify cybersecurity threats; using third party threat assessments and external intelligence feeds; and evaluating our company’s and our industry’s risk profile. We implement and maintain technical, physical, and organizational measures, processes, and/or policies, depending on the environment, designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: dedicated cybersecurity staff; an incident response plan and policy; a vulnerability management policy; risk assessment process; processes and policies to address access to systems and networks; physical security protocols; processes for asset management; encryption of certain company data, systems, and networks; penetration testing; and employee training. We also maintain cybersecurity insurance. Our assessment and management of risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is identified and addressed as a component of the Company’s general risk management strategy. We have also established a cybersecurity committee consisting of our CISO, information security team, and other senior leaders to oversee our cybersecurity risk management process and strategies to mitigate cybersecurity threats, including through trainings, incident tabletop exercises and system testing. We use third-party service providers to assist us from time to time to identify, assess, and manage risks from cybersecurity threats, including professional services firms, cybersecurity consultants, managed cybersecurity service providers and penetration testing firms. We use third-party service providers to perform a variety of functions throughout our business, such as application hosting. We have a vendor management program to manage cybersecurity risks associated with our use of certain service providers. The program includes, depending on the nature of the services and the identity of the service provider, completion of security questionnaires, review of the service provider’s written security program, and imposition of cybersecurity-related contractual obligations related on the provider. For a description of the risks from cybersecurity threats that may materially affect Heliogen and how they may do so, see our risk factors under “Item 1A. Risk Factors” contained in Part I of this Annual Report, including “If our information technology systems or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.” Governance Our Board addresses Heliogen’s cybersecurity risk management as part of its general oversight function. The Boards’ Audit Committee is responsible for overseeing Heliogen’s cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Heliogen management, including our CISO who has over 40 years of cybersecurity expertise and experience. Our CISO implements programs and policy recommendations to integrate cybersecurity risk considerations into our overall risk management strategy and works with the information security team to communicate key priorities. Our CISO is responsible for helping to prepare the Company for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our incident response plan is designed to escalate certain cybersecurity incidents to members of our incident response team and members of management depending on the circumstances, including executive management and the Board. Our CISO and information security team work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents. The Audit Committee receives periodic reports and is updated during the quarterly audit committee meetings from the CISO and information security team concerning Heliogen’s significant cybersecurity threats and risk and the processes Heliogen has implemented to address them. The Audit Committee also receives reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

Company Information