Company: SATLW
Filing Date: 2025-03-26
Form Type: 10-K
Source: 0001628280-25-014951
Chunk: 167

Company: Satellogic Inc.
Filing Date: 2025-03-26
Form: 10-K
Item: Item 1C
Chunk 167
---
, etc.•Implement a secure software development life cycle and a maturity model to assess it, and accompany engineering teams during all the phases of the cycle.•Evaluate the information security risk associated with suppliers, partners, applications and services used.We have established a committee specifically dedicated to determining the materiality of cybersecurity incidents (the “Materiality Determination Committee”), which includes key members of our organization: the CFO, Chief Information Security Officer (“CISO”), and the Sr. VP of Operations, the latter having ultimate oversight responsibility for compliance matters. Once a threat event is determined to have any impact, the committee is assembled, informed and the threat event’s material impact is determined. If materiality is confirmed, then the reporting process starts in accordance with SEC rules (including reporting no later than four days after the materiality determination).External help may be engaged at any step in the process, before or after the materiality committee is invoked, depending on the complexity and reach of the incident. Though we do not have a retainer on any external third parties, we have identified a list of potential entities to engage when needed.We have not identified any cybersecurity incident that had or may have a material impact on our business whatsoever, in particular, no unauthorized access to our information technology systems that either occurred or is 

56

Table of Contents

reasonably likely to have occurred, including of reports submitted to us by third parties (including regulatory agencies, law enforcement agencies and security consultants), to the extent that such unauthorized access to our information technology systems is reasonably likely to have a material effect on the (consolidated) financial statements, in each case or in the aggregate, and no ransomware attacks when we had been asked, paid or are contemplating paying a ransom, regardless of the amount.  However, conducting our businesses involves the collection, storage, use, disclosure, processing, transfer, and other handling of a wide variety of information, including personally identifiable information, for various purposes in our businesses. Like other comparable-sized companies that process a wide variety of information, our information technology systems, networks and infrastructure and technology are assumed to be vulnerable to cybersecurity attacks and other data security threats. These types of attacks are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target.

Our Board has ultimate oversight for risks relating to our cybersecurity strategy. In addition, the Board has delegated primary responsibility to the Audit Committee for assessing and managing data privacy and cybersecurity risks, reviewing steps management has taken to monitor and control such cybersecurity risks,