Company: HCTI
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001213900-25-026218
Chunk: 287

Company: Healthcare Triangle, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1B
Chunk 287
---
 reviewing the Company’s annual disclosures concerning the role of the Board in the risk oversight
of the Company. The Audit Committee performs an annual review of the Company’s cybersecurity program and receives quarterly updates
on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends.

32

HCTI’s technical officers have primary responsibility
for the development and oversight of HCTI’s cybersecurity team and the development and maintenance of the company’s related
cybersecurity policies and procedures. The team has several years’ worth of experience working in the information and operational
technology field and are registered professional engineers. The company’s cybersecurity team continuously assesses the evolving
cyber threat landscape based on their expertise and that of our third-party partners. They then work with all parts of HCTI to protect
against, detect, identify, respond to, and recover from the risks that cybersecurity threats present. The cybersecurity team views and
responds to cybersecurity risks in a holistic manner, applying a comprehensive multilayered strategy to prevent, detect, and mitigate
them. They have identified HCTI’s critical cyber assets and taken appropriate steps to protect them. External expertise is regularly
engaged to assess HCTI’s cybersecurity program and help the cybersecurity team to strengthen the organization’s monitoring,
alerting, prevention, mitigation, and recovery capabilities. Tabletop simulations, third party cyber vulnerability assessments, maturity
assessments, and partnerships are used to assess and refine all elements of our cybersecurity program.

In addition to managing our own cybersecurity
preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments
are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal
business owners of HCTI’s applications are required to document user access reviews regularly. We request a System and Organizational
Controls (SOC) 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional
compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed
as part of our overall cybersecurity risk management framework.

To continually manage and control the material
risks that cybersecurity threats present to the organization, HCTI invests significantly in the cybersecurity elements outlined above.
In addition, the Company has made significant investments to fulfill the operational and financial regulatory requirements laid out by
the North American Electric Reliability Corporation Critical