Company: ZCARW
Filing Date: 2025-06-30
Form Type: 10-K
Source: 0001213900-25-059675
Chunk: 108

Company: Zoomcar Holdings, Inc.
Filing Date: 2025-06-30
Form: 10-K
Item: Item 1
Chunk 108
---
 preparedness, compliance with regulatory requirements, vulnerability assessments,
    third-party and independent reviews, and other information security considerations. Our Internal Security Team also frequently
    engages with key vendors, industry groups, and law enforcement communities as part of our continuing efforts to improve our cybersecurity
    program.

    ● Approach: We use a cross-functional approach to identifying, preventing, assessing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt escalation of cybersecurity incidents and support appropriate public disclosure and reporting of incidents as required in a timely manner. Our cybersecurity efforts include the use of risk-based administrative, technical, and physical controls. Zoomcar has implemented an extensive set of policies, procedures, systems and tools designed to help safeguard our systems and data, including firewalls, intrusion detection systems, access controls including multi-factor authentication, vulnerability scanning, penetration testing, independent third-party control audits, an internal bug bounty program, and other systems and processes. 

    ●
    Incident Response
    Planning: We maintain a breach reporting and resolution plan that includes defined processes, roles, communications, responsibilities
    and procedures for responding to cybersecurity incidents and other events that impact our operations. Our incident response plans
    are tested and evaluated on a regular basis.

    ● Third-Party Risk Management: Our business relies on various services from third party service providers that could adversely impact the security of our systems and business. We have implemented processes designed to identify and assess cybersecurity risks associated with our use of third-party service providers. 

    ●
    Education and Awareness:
    We have established a security and privacy awareness program that runs throughout the year and includes training for all
    company personnel to enhance employee awareness of how to detect and respond to cybersecurity threats as well as more targeted training
    for company personnel that have increased responsibility for mitigating certain potential cybersecurity risks.

We regularly review and
update our policies, procedures, processes and practices to address changes in the threat landscape and as a result of lessons learned
from suspected, actual or simulated incidents. We also conduct tabletop exercises, and engage third party services to conduct evaluations
of our security controls through penetration testing and independent audits. We also review industry best practices to assist in evaluating
responses to new challenges and risks. These evaluations include testing both the design and operational effectiveness of security controls. 

Experience:

Our Director DevSecOps,
Mr. Mohit Kumar, is a seasoned technology leader with over 15 years of experience in DevOps, SRE,