Company: CRCT
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0001828962-25-000039
Chunk: 124

Company: Cricut, Inc.
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1C
Chunk 124
---
Item 1C. Cybersecurity

Risk Management and StrategyWe have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. The structure of our information security program is based on the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework and other industry standards. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We conduct periodic risk assessments, including vulnerability scanning and penetration testing, to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include an inventory of assets, followed by identification of reasonably foreseeable internal and external vulnerabilities, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We monitor various cybersecurity resources to remain informed about new and emerging cybersecurity threats and attack vectors. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (“CISO”), who reports to our Executive Vice President of Platform Development, to manage the risk assessment and mitigation process. As part of our overall risk management system, we monitor and test our safeguards and train our employees on recognizing potential cybersecurity threats and implementing our safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings. We also conduct tabletop exercises for members of various functional areas on data recovery and incident response. We engage security consultants and other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures,  as well as to monitor and test our safeguards and to conduct regular vulnerability assessments for our internal assets. We require each third-party service provider to give assurance that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We review third-party service providers’ policies, data protection procedures, intellectual property protection measures and incident response