Company: BWMN
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001628280-25-012365
Chunk: 136

Company: Bowman Consulting Group Ltd.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1C
Chunk 136
---
Item 1C. Cybersecurity

Cybersecurity Risk Management and Strategy

We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk awareness and management. This integration aims to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. We have developed an enterprise risk management program (“ERM”) designed to assess, identify, manage and mitigate material risks, including cybersecurity risk. ERM is a Company-wide initiative that involves both the board of directors and our management. The program is designed to identify and assess risks most critical to our success including through an analysis of the likelihood of occurrence and potential impact of each risk. The executive leadership team, including our Chief Executive Officer, and our management team, comprised of department leaders and subject matter experts, are responsible for identifying, assessing, managing and mitigating risks with Board appropriate oversight. Our cybersecurity risk management includes enterprise-wide monitoring of cyber activity to identify and analyze potential events that may have an adverse effect or impact on our services, systems, resources, or reputation. This monitoring is designed to identify both external activity and routine internal activity for behavior that may be unusual or potentially malicious. Our cybersecurity monitoring and identification efforts include the use of a third- party managed detect and response security service to monitor and take action as necessary, with the response ranging from automated processes to immediately block and remove undesired risks to cybersecurity team review and action, depending on the nature and severity of the risk. We have a Cybersecurity Incident Response Plan which provides a framework for addressing a cyber-crisis, cyber-incident and/or data breach, and includes activating crisis, or business continuity recovery plans, as appropriate. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the aim of modeling our cybersecurity strategies and processes after industry best practices. Our collaboration with these third parties includes vulnerability management, threat and attack and consultation on security risks enhancements. Some engagements involve point in time activities with end products or reporting while others involve ongoing monitoring and management of risk across the Company.We do not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected us. However, the sophistication of cyber threats continues to increase, and the preventative