Company: GAUZ
Filing Date: 2025-03-11
Form Type: 20-F
Source: 0001213900-25-022437
Chunk: 144

Company: Gauzy Ltd.
Filing Date: 2025-03-11
Form: 20-F
Item: Item 16K
Chunk 144
---
ITEM 16K. CYBERSECURITY

While we have implemented
various controls, systems and processes intended to secure our systems and the information on it, we are in the process of developing
a cybersecurity risk management program, consisting of cybersecurity policies, procedures, compliance and awareness programs to mitigate
risk and to ensure compliance with security, availability and confidentiality trust principles. Following the completion of
the development of our cybersecurity risk management program, the cybersecurity process will be
integrated
into our overall risk management
system and process, and, initially, will be solely internally managed. Management is responsible for identifying risks that threaten
achievement of the control activities stated in the management’s description of the services organizations systems. Management
has started to implement a process for identifying relevant risks that could affect the organization’s ability to provide secure
and reliable service to its users. The risk assessment will occur annually, or as business needs change, and covers identification of
risks that could act against the company’s objectives as well as specific risks related to a compromise to the security of data. Most
of the information generated and collected by us is stored and maintained bythird-partyvendors and service providers. We believe that
each of these providers has its own cybersecurity protocols to which our management believes to be adequate for protecting our files
in their possession. See “ Item 3. D - Risk Factors - Risks Related to Regulations - We and our third-party vendors
face cybersecurity risks and may incur increasing costs in an effort to mitigate those risks, and if we fail to prevent data security
breaches, there may be damage to our reputation, material financial penalties, and legal liability, which would materially adversely
affect our business, results of operations, and financial condition. ”

The level of each identified
risk is determined by considering the impact of the risk itself and the likelihood of the risk materializing and high scoring risks are
actioned upon. Risks are analyzed to determine whether the risk meets company risk acceptance criteria to be accepted or whether a mitigation
plan will be applied. Mitigation plans include both the individual or department responsible for the plan and may include budget considerations.

Governance

The oversight of cybersecurity
threats is undertaken by our Global IT Director, who holds over 20 years of experience in information technology and the design and architecture
of information systems, and is supported by management. Our
audit committee
is responsible for cybersecurity oversight and monitoring
risk. Following the completion of the development of our cybersecurity risk management program, the audit