Company: ACTG
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0000934549-25-000004
Chunk: 126

Company: ACACIA RESEARCH CORP
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1C
Chunk 126
---
 incidents in the normal conduct of our business, thus far to our knowledge, such incidents have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.

Governance

Management PersonnelOur internal cybersecurity control group has responsibility for assessing, monitoring, and managing risks related to cybersecurity threats. The control group is comprised of members of senior leadership, including in-house legal counsel, and multiple independent third-party Certified Information Systems Security Professional (CISSP) Information Technology and Cybersecurity consultants. Specifically, we have retained a Virtual Chief Information Security Officer and other members of our cybersecurity control group, each of whom supports our cybersecurity risk management and governance practices. Such retained individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our internal cybersecurity control group and executive team on a regular basis (at least monthly).

Monitor Cybersecurity Incidents

Our internal cybersecurity control group meets monthly or on a more frequent basis if needed, to discuss and assess risks related to cybersecurity threats and review any reported cybersecurity incidents. The reviews include a review of the incident log, assessments of risks identified by multiple independent third parties and a review of our cyber risk as well as cybersecurity threat modeling. Identified risks related to cybersecurity threats are further analyzed as part of our enterprise risk management process. Our employees are provided with regular security policy and security awareness training including identifying potential cybersecurity incidents and reporting them to our security incident response team.

Board of Directors OversightThe Audit Committee of our Board of Directors has oversight responsibility for the policies, processes and risks relating to cybersecurity. A senior member of our internal control group attends all scheduled Audit Committee meetings and provides in-depth reports to the committee on cybersecurity risks and updates on the status of projects to strengthen the Company’s cybersecurity systems and improve cyber readiness. Moreover, on a quarterly basis, a senior member of our internal control group reports to the Audit Committee and assists the committee with its review of relevant cybersecurity risks and evaluation and updating of our Cyber Risk Controls. Certain members of our Audit Committee have specific experience in 

45

Table of Contents

information security and cybersecurity, and the Company has made cybersecurity training available to members of the Audit Committee.