ENZO BIOCHEM INC 10-K Cybersecurity GRC - 2024-10-29

Page last updated on October 29, 2024

ENZO BIOCHEM INC reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-10-29 17:04:55 EDT.

Filings

10-K filed on 2024-10-29

ENZO BIOCHEM INC filed a 10-K at 2024-10-29 17:04:55 EDT
Accession Number: 0001213900-24-091798

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity Risk Management and Strategy We have implemented and maintain various information security processes and technologies designed to identify, assess and manage material risks from cybersecurity threats to our computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature (“Information Systems and Data”). Our Senior VP of Global IT and System Operations, IT Security Officer and the information security team, in conjunction with our legal team and third-party service providers, help identify, assess and manage our cybersecurity threats and risks. Our Senior VP of Global IT and System Operations, IT Security Officer and the information security team identify and assess risks from cybersecurity threats by continuously monitoring and evaluating our threat environment using various methods, including, for example: conducting vulnerability assessments to identify vulnerabilities, conducting scans of corporate devices and network infrastructure, analyzing reports of potential, known and identified threats and actors, using automated and manual tools to monitor for, identify, or evaluate threats and risks, conducting audits and threat assessments, and utilize third party managed detection and response (MDR) 24/7/365 cybersecurity vendor services that help identify cybersecurity threats, using third party threat assessments and external intelligence feeds, and evaluating our company’s and our industry’s risk profile. We implement and maintain technical, physical, and organizational measures, processes, and policies that are designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: dedicated cybersecurity staff, an incident response plan and policy, a vulnerability management policy, risk assessment process, processes and policies to address access to systems and networks, physical security protocols, processes for asset management, encryption of certain Company data, systems and networks, penetration testing, IT risk assessments and employee training. We also maintain cybersecurity insurance. Our assessment and management of risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is identified and addressed as a component of our general risk management strategy. We have also established a cybersecurity committee consisting of our Senior VP of Global IT and System Operations, IT Security Officer, information security team, and other senior leaders to oversee our cybersecurity risk management process and strategies to mitigate cybersecurity threats. We use third-party service providers to assist us from time to time to identify, assess, and manage risks from cybersecurity threats, including professional services firms, cybersecurity consultants, managed cybersecurity service providers and penetration testing firms. We have a vendor management program to manage cybersecurity risks associated with our use of certain service providers. The program includes, depending on the nature of the services and the identity of the service provider, completion of security questionnaires, review of the service provider’s written security program, and imposition of cybersecurity-related contractual obligations on the provider. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Item 1A. Risk Factors of this Form 10-K, including " Cybersecurity risks and the failure to maintain the confidentiality, integrity, and availability of our computer hardware, software and internet applications and related tools and functions could result in dam age to the Company’s reputation and/or subject the Company to costs, fines, or lawsuits" , and " We rely on network and information systems and other technology whose failure or misuse could cause, and has caused, a disruption of services or loss or improper disclosure of personal data, business information, including intellectual property, or other confidential information, resulting in increased costs, loss of revenue or other harm to our business." 20 Governance Our Board addresses the Company’s cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by our Senior VP of Global IT and System Operations and IT Security Officer. Our Senior VP of Global IT and System Operations in conjunction with the IT Security Officer implements programs and policy recommendations to integrate cybersecurity risk considerations into our overall risk management strategy and works with the information security team to communicate key priorities. Our Senior VP of Global IT and System Operations and IT Security Officer are responsible for helping to prepare the Company for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our incident response plan is designed to escalate certain cybersecurity incidents to members of our incident response team and members of management depending on the circumstances, including executive management and the Board. Our Senior VP of Global IT and System Operations, IT Security Officer and information security team work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the Governance and Compliance Committee (“the Committee”) for certain cybersecurity incidents. The Committee periodically evaluates overall business continuity, compliance, regulatory, quality and safety systems effectiveness. The Committee includes, but is not limited to, the Company’s IT Security Officer, Data Privacy Officer, Safety Officer, and Senior VP of Global IT and System Operations. The Committee is updated during the quarterly Committee meetings by the Senior VP of Global IT and System Operations and the IT Security Officer concerning the Company’s significant cybersecurity threats and risk and the processes we have implemented to address them. The Committee also receives reports, summaries or presentations related to cybersecurity threats, risk and mitigation. The Company’s Senior VP of Commercial Operations, General Counsel, Chief Financial Officer and Chief Executive Officer may also participate in Committee meetings and will receive updates from the Committee as appropriate.

Company Information