Company: PGYWW
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001883085-25-000050
Chunk: 245

Company: Pagaya Technologies Ltd.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1C
Chunk 245
---
Item 1C. Cybersecurity

Risk management and strategy

Our information security program is designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our customer data (“Information Systems and Data”). Our information security program consists of processes and controls around access control, authorization, auditing, and monitoring, and is supported by our cybersecurity tech ecosystem, all of which is designed to protect our business flows and Information Systems and Data.The information security program is overseen by our Chief Information Security Officer (“CISO”), who manages a team responsible for leading enterprise-wide cybersecurity policy, standards, architecture, and processes.   As an organization that has become increasingly interconnected, we have defined a set of cybersecurity principles designed to support the continuous improvement of our overall information security measures, utilizing technology and controls to protect our core assets, infrastructure, Information Systems and Data throughout the entire life cycle of our business. In addition, we are aligned with the SOC 2 Type 2 standard and, since 2019, we have been certified under ISO 27001:2013, ISO 27017:2015 & ISO 27018.Our identification, assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company’s enterprise risk management program and identified in the Company’s risk register; (2) the CISO works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and (3) our Technology Risk Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Risk Committee of our Board of Directors, which evaluates our overall enterprise risk.We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence providers, cybersecurity consultants and software providers, managed cybersecurity service providers, penetration testing service providers, dark web monitoring service providers, and forensic investigators.  

64

Table of Contents

In addition, our third party risk management program manages cybersecurity risks associated with our use of third-party service providers that perform a variety of functions throughout our business, such as software-as-a-service providers, hosting companies, distributors, and supply chain resources. Depending on the nature of the services provided, the sensitivity