HEALTHY CHOICE WELLNESS CORP. 10-K Cybersecurity GRC - 2025-03-27

Page last updated on March 28, 2025

HEALTHY CHOICE WELLNESS CORP. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2025-03-27 19:43:34 EDT.

Filings

10-K filed on 2025-03-27

HEALTHY CHOICE WELLNESS CORP. filed a 10-K at 2025-03-27 19:43:34 EDT
Accession Number: 0001641172-25-001000

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity We recognize that cybersecurity is of critical importance to our success. We are susceptible to a number of significant and persistent cybersecurity threats, including those common to most industries as well as those we face as a retailer, operating in an industry characterized by a high volume of customer transactions and collection of sensitive data. These threats, which are constantly evolving, include data breaches, ransomware, and phishing attacks. We, and our vendors and suppliers, regularly face attempts by malicious actors to breach our security and compromise our information technology systems. A cybersecurity incident impacting us or any vendor or supplier could significantly disrupt our operations and result in damage to our reputation, costly litigation and/or government enforcement action. Accordingly, we are committed to maintaining robust cybersecurity and data protection and continuously evaluating the impact of cybersecurity threats, considering both immediate and potential long-term effects of these threats on our business strategy, operations, and financial condition. 8 Our Chief Operating Officer is primarily responsible for managing material risks from cybersecurity threats, and is supported by third party cybersecurity specialists. Management participates in periodic training and education on cybersecurity related topics. We engage specialized cybersecurity consultants and leverage third-party expertise to bolster our cybersecurity defenses. Our enterprise risk management program is designed to identify, prioritize and assess a broad range of risks, including risks from cybersecurity threats, that may affect our ability to execute our corporate strategy and fulfill our business objectives. The following is a list of measures that were implemented as part of our increased focus on cybersecurity: ● Complete endpoint protection - All endpoints have been covered by an enhanced endpoint protection agent. ● Cloud infrastructure - Critical infrastructure started moving to the cloud and protected by enhanced anti-virus and recurring backup policies. ● Email services have been put through a rigorous intelligent phishing and spam filter to prevent attacks. In addition, our third-party vendors and service providers play a role in our cybersecurity . These third parties are integral to our operations but pose cybersecurity challenges due to their access to our data and our reliance for various aspects of our operations, including our supply chain. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards. As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations. However, despite the comprehensive measures outlined above, management has identified a material weakness in our cybersecurity setup, specifically regarding access controls and data encryption, This weakness increases the risk of a significant cybersecurity incident. We are actively developing and implementing a remediation plan to address this material weakness. We are committed to resolving this issue promptly and enhancing our overall cybersecurity posture. Notwithstanding our remediation efforts, we acknowledge that we may not be successful in preventing or mitigating all potential cybersecurity incidents that could have a material adverse effect on us.

Company Information