preparedness, and assessments led by outside auditors. The Chair of the Audit Committee, in turn, reports on these topics to the Board of Directors as and when deemed necessary and/or material. Overall, our Board contains two directors with work experience related to cybersecurity issues or oversight.
We rely heavily on our technology and infrastructure, as well as the public cloud to an increasing degree, to provide our products and services to our customers. As a result, we have developed an ISO/IEC 27001-certified Information Security Management System (“ISMS”) to enhance our corporate security measures, identify and mitigate information security risks, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by the Company and that of its customers and suppliers in our control. Our ISO certification can be verified on the BSI Group website using certificate number IS 649202.
Our ISMS includes developing, implementing, and continually improving policies and procedures to safeguard information and ensure the availability of critical data and systems. These policies cover areas such as requiring secure coding practices and a secure development lifecycle process, monthly information security awareness training for all employees and enhanced training for specialized personnel, review and assessment by external, independent third parties, who certify and report on any weaknesses and our internal response preparedness for the entire Company, and the performance of routine and risk-based vulnerability scanning of our network infrastructure as well as annual third-party penetration testing.
Our cybersecurity risk assessment, identification, and management process consists of a dedicated Governance Risk and Compliance (“GRC”) team, within our Information Security organization, that implements a repeatable, ISO/IEC 27001-compliant methodology to assess and track cybersecurity risk. This team, reporting to and working with the CISO, identifies, tracks, and updates cybersecurity risks that threaten the Company directly and through third parties. The GRC team collaborates closely with risk owners throughout the Company, vendors, and suppliers, working with them in an effort to ensure their risks are identified, documented, and mitigated in a timely fashion.
In addition to our active ISO/IEC 27001 certification, the Company also assesses itself against the National Institute of Standards and Technology (NIST) Special Publication 800-171 as required by the Defense Federal Acquisition Regulation Supplement (“DFARS”). The Company has also achieved Cybersecurity Maturity Model Certification Level 2 (CMMC L2), reflecting an independent assessment against applicable Department of War cybersecurity requirements. In accordance with our ISMS, we also actively monitor known threats that could affect our products and services and work with our suppliers to provide us with real-time reports of threats or vulnerabilities that may affect our enterprise-wide systems. Our program also includes a cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident as well as a business continuity plan that provides a clear framework for how the Company can continue in the event of any significant disruption to ensure that we can offer the same level of security, support, and excellence to all our customers. In the normal course, our Security and GRC teams engage assessors, consultants, and other third parties to assist in various cyber-related matters. For example, to maintain our ISO certification, the Company utilizes an external third party to conduct yearly audits of its ISMS. Our Information Security organization also leverages third-party advisors, as appropriate, for various tasks such as conducting annual third-party penetration testing.
In 2025, we conducted an enterprise risk assessment that included an assessment of cybersecurity risk in the context of other enterprise-level risks. Furthermore, our CISO and our General Counsel regularly discuss cybersecurity risk mitigation. We carry errors and omissions insurance that provides some protection against the potential losses arising from a cybersecurity incident.
In 2025, we did not experience a material information security breach incident and had no penalties or settlements related to the same, and any expenses we incurred from information security breach incidents were immaterial.
In one form or another, our solutions are entirely dedicated to protecting our customers’ people, information and digital assets, and we take pride in producing products and services in support of that goal. We acknowledge that information and data security are of paramount importance to our business and our customers – to that end, we are focused on improving our information security practices and mitigating information security risk.
Environmental, Social and Governance (ESG) Matters
Our Board and management believe that operating our business in line with solid governance principles and in a socially and environmentally responsible manner furthers our core values and creates the greatest value for our stakeholders. We further believe that our environmental, social and governance priorities should support sustainable long-term financial performance.