Emmaus Life Sciences, Inc. 10-K Cybersecurity GRC - 2024-07-02

Page last updated on July 16, 2024

Emmaus Life Sciences, Inc. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-07-02 18:52:36 EDT.

Filings

10-K filed on 2024-07-02

Emmaus Life Sciences, Inc. filed a 10-K at 2024-07-02 18:52:36 EDT
Accession Number: 0000950170-24-080918

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBERSECURITY Risk Management and Strategy We periodically assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity processes, and practices as part of our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. George Sekulich, our Co-President and former Chief Information Officer, in consultation with our third-party information technology, or IT, vendor assesses risks based on probability and potential impact to our business and information systems and processes. Any identified risks that are considered high are monitored and tracked as part of our overall risk management program overseen by our board of directors. We collaborate with our third-party IT vendor to assess the effectiveness of our cybersecurity prevention and response systems and processes and have not had a need to utilize cybersecurity assessors, consultants or other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks or to support any necessary mitigation plans. Neither cybersecurity incidents or cybersecurity threats have materially affected our company, including our business strategy, results of operations, or financial condition. We are not aware of any cybersecurity threats that are reasonably likely to materially affect our company. Refer to the risk factor captioned " Our business and operations may be adversely affected by information technology (“IT”) system failures or cybersecurity or data breaches" in Part I, Item 1A. “Risk Factors” for additional description of cybersecurity risks and potential related impacts on our Company. Governance Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks. We take a risk-based approach to cybersecurity and have implemented cybersecurity policies in collaboration with our IT vendor that are designed to address cybersecurity threats and incidents. As Co-President, Mr. Sekulich, or former Chief Information Officer, is currently responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Mr. Sekulich has over 25 years of experience in information security and possesses the requisite expertise and experience expected of such an individual given our company’s risk profile. Mr. Sekulich provides periodic updates on any cybersecurity incidents and threats to our Board of Directors and to the Audit Committee of our board of directors as such incidents may arise.

Company Information