NICHOLAS FINANCIAL INC 10-K Cybersecurity GRC - 2024-07-01

Page last updated on July 16, 2024

NICHOLAS FINANCIAL INC reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-07-01 16:26:20 EDT.

Filings

10-K filed on 2024-07-01

NICHOLAS FINANCIAL INC filed a 10-K at 2024-07-01 16:26:20 EDT
Accession Number: 0000950170-24-079650

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity Risk Management and Strategy We are committed to maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we have implemented a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction of our information assets. We are committed to ensuring the security and protection of our Company’s information assets and the personal information of our employees, customers, and stakeholders. We recognize that cybersecurity threats are constantly evolving and have the potential to cause significant harm to our Company and our stakeholders. In order to address these risks, we have established a cybersecurity risk management framework that is aligned with industry best practices and regulatory requirements. Our program includes regular risk assessments, vulnerability management, access controls, incident response planning, and employee training and awareness programs. We also work closely with third-party service providers to ensure that they are meeting our cybersecurity standards. There can be no assurance that our cybersecurity program will prevent all incidents. In the event of a cybersecurity incident, we have established procedures for prompt investigation, containment, and remediation to minimize the impact on our operations and stakeholders. We believe that our cybersecurity program is robust and effective, and we will continue to invest in and improve our capabilities to address evolving threats. We are committed to transparency and will provide updates on any material cybersecurity incidents that may impact our Company or our stakeholders. During the fiscal year ended March 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K. 25 Governance Our board of directors addresses the Company’s cybersecurity risk management as part of its general oversight function. The board of directors’ audit committee is responsible for overseeing Company’s cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company personnel. Our IT staff has over 30 years of experience in roles that include oversight of cybersecurity risk management programs. In addition, the IT staff is consulted by an external agency with long term expertise in cybersecurity. Our IT staff is responsible for helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CEO, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company’s incident response processes include reporting to the audit committee for certain cybersecurity incidents. The audit committee will receive periodic reports from our management concerning cybersecurity issues, including certain threats and risks and the processes the Company has implemented to address them, as applicable. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

Company Information