ENERGY FOCUS, INC/DE 10-K Cybersecurity GRC - 2024-03-22

Page last updated on April 11, 2024

ENERGY FOCUS, INC/DE reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-22 15:24:31 EDT.

Filings

10-K filed on 2024-03-22

ENERGY FOCUS, INC/DE filed an 10-K at 2024-03-22 15:24:31 EDT
Accession Number: 0001628280-24-012713

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBERSECURITY Governance Cybersecurity is an integral part of the Board s risk analysis and discussions with management. At least annually, the full Board is updated on the Company s cybersecurity risks and risk mitigation strategy by our Director of Operations & Information Technology, who is responsible for management of our Information Technology program. The Board also receives ad hoc updates, as needed, about material changes to the Company s cybersecurity program and/or the cybersecurity landscape, including briefings on major legislative and regulatory developments, from our Director of Operations & Information Technology. Our Director of Operations & Information Technology regularly evaluates the Company s cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team. Our Director of Operations & Information Technology has approximately 20 years of experience in his field, and Bachelor of Science in Information Technology Concentration in Information Systems Security and an MBA in Business Analytics. We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. The Cybersecurity Incident Response Plan, designed for our business environment, features the Director of IT and Operations as the incident coordinator. In the event of any suspicious activity or security breach, Energy Focus swiftly conducts an assessment to gauge the severity and scope of the incident, employing thorough investigation techniques to identify the root cause and affected systems. Immediate containment measures are then executed to prevent further unauthorized access or damage. Throughout the incident response process, transparent and timely communication is upheld with internal stakeholders and relevant external parties, ensuring alignment, and understanding of response efforts. Following successful mitigation and restoration of normal operations, Energy Focus conducts a comprehensive post-incident review to glean insights and lessons learned. These findings inform ongoing enhancements to our cybersecurity protocols, further bolstering our resilience against future threats. The incident coordinator oversees the detection, containment, and recovery procedures outlined in the plan. Effective communication protocols ensure timely notification to both internal and external stakeholders. Regular training sessions bolster staff preparedness, while post-incident reviews facilitate continuous improvement. Appendices offer essential contact information and tools necessary for incident response. Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. This annual training is customized to address specific cybersecurity challenges and scenarios that we may face within the real estate investment industry. Novel cybersecurity threats to the Company that are identified by our Information Technology team are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber-attacks. Risk Management and Strategy 24 Table of Contents We maintain an Enterprise Risk Management ( ERM ) program to identify and respond to the most critical risks to our business, including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at least annually as part of our ERM program. In response to such assessments, controls are embedded into our processes and technology by our Director of Operations & Information Technology to seek to mitigate risks to our systems and processes from cybersecurity incidents. We continuously evaluate if we have adequate controls in place utilizing a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST). Our information technology department diligently monitors our daily operations, overseeing the security of our computer networks through implemented systems and processes aimed at safeguarding sensitive data. Utilizing encryption and authentication technologies, we fortify our systems against unauthorized access and data loss. This proactive approach ensures the integrity and confidentiality of our data, mitigating potential risks posed by cyber threats. In assessing cybersecurity risks, we adopt a risk-based approach, particularly concerning third-party vendors integral to our operations. Vendors meeting specific criteria, including ownership and operation of information technology networks critical to our operations, undergo evaluation across various domains such as data security and operations management. Effective communication channels with these vendors are maintained to enable timely notification of any cybersecurity incidents that could impact our company. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors information systems. For more information, please see Item 1A. Risk Factors - Increased Information Technology ( IT ) security threats and more sophisticated computer crime could pose a risk to our systems, networks, and services. Our Director of Operations & Information Technology regularly evaluates the Company s cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team. Our Director of Operations & Information Technology has approximately 20 years of experience in his field, and our Director of Operations & Information Technology holds certifications in cybersecurity from accredited information technology certification providers. We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. Our Cybersecurity Incident Response Plan provides a documented framework for responding to cybersecurity incidents in coordination across multiple departments. In the event of such an incident, our Cybersecurity Incident Response Team ( CIRT ), which is comprised of our Director of Operations & Information Technology, Director of Risk Management and representatives from Risk Management, Legal and Financial Reporting, would respond to such incident in accordance with our Cybersecurity Incident Response Plan. Any cybersecurity incident that meets certain criteria will be communicated by the CIRT to senior management and the Board in a timely manner, and will be evaluated by our Executive Management Team, comprised of certain executives, to assess the impact of the incident on the Company, considering qualitative and quantitative factors. In conducting this assessment and responding to an incident, the CIRT and Executive Management Team may utilize the services of third-party consultants. Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. This annual training is customized to address specific cybersecurity challenges and scenarios that we may face within the real estate investment industry. Novel cybersecurity threats to the Company that are identified by our Information Technology team are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber-attacks.

Company Information