Company: IRDM
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001628280-25-005302
Chunk: 88

Company: Iridium Communications Inc.
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 88
---
Item 1C. Cybersecurity

Risk management and strategyWe have implemented and maintain information security processes designed to identify, assess and manage material risks from cybersecurity threats to our information systems and critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature. Our most important information system is our satellite network and related ground systems that carry our customers’ traffic on our network. We also maintain critical internal computer networks, as well as third-party hosted services, communications systems, hardware and software. Our management, led by our chief information officer, in conjunction with our internal management security committee and third-party service providers, helps to identify, assess and manage our cybersecurity threats and risks by monitoring and evaluating our threat environment and risk profile. These teams use a number of methods to do this, including manual and automated tools, internal and external threat assessments, and internal and external vulnerability assessments. The third parties we engage in this effort generally consist of threat intelligence service providers; cybersecurity consultants and software providers; penetration testing firms; monitoring services; forensic investigators; and other professional services firms, including legal counsel. Depending on the environment and system, we implement and maintain several technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our systems and data. These include, for example, IT policies and procedures; a network security policy; an information and asset management policy; an information security policy; incident planning, detection and response plans, including backup systems; vulnerability management, including of third parties; risk assessments; establishment of network security controls, including physical security; annual employee training; systems monitoring; and penetration testing. We integrate our assessment and management of material risks from cybersecurity threats into our overall risk management processes. For example, our management security committee generally meets on a monthly basis and evaluates material risks from cybersecurity threats against our overall business objectives. Our management generally provides reports and status updates to our board of directors on a quarterly basis, as the board monitors our overall enterprise risk.In addition to our internal resources, we also use third-party service providers, including application providers and hosting companies, distributors, and supply chain resources. We have an IT vendor management program designed to identify and manage cybersecurity risks associated with our use of these providers. As part of this program, we typically conduct risk assessments for certain IT vendors on an annual basis, including, for example, using security assessment measures such as a security questionnaire, perform a review of the vendor’s own security program, audits, and vulnerability scans. Depending on the nature