Company: RILYN
Filing Date: 2025-09-19
Form Type: 10-K
Source: 0001464790-25-000011
Chunk: 215

Company: B. Riley Financial, Inc.
Filing Date: 2025-09-19
Form: 10-K
Item: Item 1C
Chunk 215
---
Item 1C. CYBERSECURITY

We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These processes include internal and external vulnerability management systems, security grading systems, scanning systems, firewalls and breach alert systems, among others. Such systems and processes are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. As part of our risk management process, we conduct monthly vulnerability scans, annual penetration testing, phishing tests, annual risk assessments, and ad-hoc application security assessments. We also maintain a variety of playbooks for our incident response plan that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity and compliance training at least annually.

In addition, we engage certain third-party security providers to assist with assessing, identifying, and managing cybersecurity risks. Such services include but are not limited to managed security providers, assessors, consultants, auditors, and penetration testers. We also use a third party vendor management software to assess the security posture of other material third party vendors to reduce the impact of a security incident from such vendors. As discussed below, we rely on notifications from third-parties and other external alert systems to identify material risks that may exist with such parties. 

Our cybersecurity team is led by our chief information security officer, who is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with senior management and other teams across the Company. The chief information security officer provides regular updates to the Cybersecurity Committee (discussed further below) of which he is also a member. Our chief information security officer has extensive cybersecurity knowledge and skills gained from over 20 years of experience at the Company as chief information security officer and chief information officer where he has been responsible for implementing and maintaining cybersecurity and data protection practices, implementing complex technology solutions, and managing large groups of technology professionals. He holds multiple cybersecurity industry focused certifications and reports directly to the Co-Chief Executive Officer. 

49

Table of Contents

Cybersecurity incidents come to the attention of the Company from the cybersecurity team which may be notified of