Company: SPWH
Filing Date: 2025-04-02
Form Type: 10-K
Source: 0000950170-25-048890
Chunk: 293

Company: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.
Filing Date: 2025-04-02
Form: 10-K
Item: Item 1C
Chunk 293
---
Risk management and strategy

We implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our customers and outfitters.

Our Information Security Department and Security Management functions, led by our Chief Information Officer (“CIO”) and supported by our Director of Information Security and Compliance, (collectively, “Security Team”), help identify, assess and manage the Company’s cybersecurity threats and risks. The Security Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated tools in certain environments and systems, internal and external audits of certain environments and systems, conducting scans of certain threat environments, evaluating our and our industry’s risk profile, analyzing certain reports of threats and actors, conducting threat assessments for internal and external threats (including third party threat assessments) in certain environments, coordinating with law enforcement concerning select threats, subscribing to reports and services that identify cybersecurity threats, use of external intelligence feeds, conducting tabletop incident response exercises, evaluating certain threats reported to us, and conducting vulnerability assessments of certain environments and systems.

Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident response policy, vulnerability management policy, risk assessments, encryption of certain data, network security controls and data segregation for certain environments and systems, access controls for certain environments and systems (such as identity controls and quarterly user access reviews), physical security, systems monitoring for certain systems, vendor risk management program, system configuration standards, outfitter security awareness training, asset management,  managed detection and response tools, penetration testing, cybersecurity insurance and dedicated cybersecurity staff.