Airsculpt Technologies, Inc. 10-K Cybersecurity GRC - 2024-02-27

Page last updated on April 11, 2024

Airsculpt Technologies, Inc. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-02-27 14:39:44 EST.

Filings

10-K filed on 2024-02-27

Airsculpt Technologies, Inc. filed an 10-K at 2024-02-27 14:39:44 EST
Accession Number: 0001870940-24-000005

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity The Company operates in the body contouring and cosmetic surgery industry, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices, specifically the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We conduct a yearly third-party Security Risk Assessment (SRA) to identify the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We also use this SRA to inform our yearly Cybersecurity roadmap and strategies to ensure the best IT security posture is implemented at the Company. We use various tools and methodologies to manage cybersecurity risk, including the use of a managed Enterprise Detection and Response (EDR) software with external Security Operations Center (SOC) real-time monitoring, email Data Loss Prevention (DLP) enabled, Multi-factor Authentication (MFA) mandatory in our IT environment, and Managed Detection and Response (MDR) for our Local Area Network (LAN) monitoring. All laptops and mobile endpoints are protected with an Operating System (OS) specific Mobile Device Management (MDM) software, which can be remotely disabled if necessary. In addition, we do daily cloud backups and regularly test the process to recover any lost or corrupted data. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests, and threat intelligence feeds, conducted by our third-party Managed Service Provider (MSP). We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They might also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. 46 Table of Contents Our Board of Directors exercises its oversight role through the Audit subcommittee, which provides the Board with regular reports and findings from our Chief Information Officer (“CIO”). Our Audit Committee Chair holds a Certification in Cybersecurity Oversight from the National Association of Corporate Directors. Our CIO has 30+ years of experience in Information Technology, 10 years specifically in IT and IT Security combined. The CIO also has a Ph.D. in Cybersecurity Management, and has taken multiple companies through both NIST and HiTrust Cybersecurity Framework Audits.

Company Information