Company: RSI
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001793659-25-000047
Chunk: 195

Company: Rush Street Interactive, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 195
---
ITEM 1C. CYBERSECURITY

Our process for identifying, assessing and managing material risks from cybersecurity threats is part of our broader risk management system and processes. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our offerings, infrastructure and corporate resources. As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits and risk assessments. We also maintain a variety of incident response plans, playbooks and processes that are utilized if and when incidents are detected.In addition, we have processes in place to govern our third-party vendor security risks. We generally gather information, usually through questionnaires, from certain third parties who contract with the Company and receive sensitive data from us or have access to or integrate with our systems, in order to help us assess potential risks associated with their security processes. We also generally require third parties to, among other things, maintain security controls to protect confidential information and data, and generally notify us of any data breaches that may impact our data through obligations that are documented in data processing or other agreements. In addition, we carry insurance that provides certain, limited protection against losses arising from a cybersecurity incident. Internally, we have a security awareness program, which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. These trainings are mandatory for all employees and take place throughout the year, and it is supplemented by testing initiatives, including periodic phishing tests. We also provide access to specialized training for certain employee roles, such as application developers. Finally, our privacy and data protection program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information. 

From time to time, we engage assessors, consultants, auditors, or other third-party service providers to enhance risk mitigation efforts. For instance, we periodically perform simulations and tabletop exercises for our technical teams and senior leaders to prepare for a possible cyber crisis and incorporate external resources and advisors as needed. We also engage third-party consultants and service providers to assist with penetration testing, security audits and vulnerability assessments in certain jurisdictions. 

While our full Board has overall responsibility for risk oversight and is currently overseeing our business continuity, regulatory and compliance risks, it is supported in this function by