Applied Digital Corp. 10-K Cybersecurity GRC - 2024-08-30

Page last updated on August 30, 2024

Applied Digital Corp. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-08-30 07:03:36 EDT.

Filings

10-K filed on 2024-08-30

Applied Digital Corp. filed a 10-K at 2024-08-30 07:03:36 EDT
Accession Number: 0001144879-24-000216

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity Cybersecurity Risk Management We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. 43 During the fiscal year ended May 31, 2024, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure. In the ordinary course of our business, we collect and store sensitive data, including intellectual property. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of a wide array of policies, standards, architecture, and processes. The cyber risk management program falls under the responsibility of our Vice President of Security who has over 18 years of experience in cybersecurity and compliance. Under the guidance of a third party consultant and our Vice President of Security, we developed and maintain policies, standards, and processes in a manner consistent with applicable legal requirements. We utilize a third party, and our in-house staff for monitoring and support of security incident management and user support. We have implemented and maintain a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and ensure the effectiveness of our security controls. Our cybersecurity risk management program is intended to address applicable SOC2 and SOX requirements. Our cybersecurity risk management program incorporates several components, including information security program assessments, a risk register, continuous monitoring of critical risks from cybersecurity threats using automated tools, backup testing, periodic threat testing, and employee training. We deploy a wide range of security tools, use single sign-on, and require multifactor authentication across all systems. We also utilize access control policies to further limit access to data within the systems, including quarterly reviews, generally, and on a weekly basis for financial operations. We periodically engage third parties, which are subject to our standards, policies, and procedure, to conduct audits, risk assessments, including penetration testing and other system vulnerability analyses. As a result of these assessments and testing, we have responded to all known medium, high, and critical risks and are constantly hardening our environment. Additionally, our program includes privacy and cybersecurity training for all employees. Training occurs prior to accessing the system or performing assigned duties, when required by system changes, and annually thereafter. Governance Our Board is responsible for the oversight of cybersecurity risk management. The Board delegates oversight of the cybersecurity risk management program to the Audit Committee. The management of the program is the responsibility of our Risk Management Committee, comprised of our Chief Executive Officer, Chief Financial Officer and Chief Technology Officer. The Risk Management Committee generally provides quarterly updates to the Audit Committee on our cybersecurity risk management program, including updates on (1) any critical cybersecurity risks; (2) ongoing cybersecurity initiatives and strategies; (3) applicable regulatory requirements; and (4) industry standards. The Risk Management Committee also notifies the Board of any significant and/or material cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

Company Information