Company: IMXI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001683695-25-000030
Chunk: 62

Company: International Money Express, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 62
---
 composed of members from our Executive Management team and key Information Technology (“IT”) personnel.The foundation of our Cybersecurity Program is based on recognized best practices and standards for cybersecurity and information technology that include the Center of Internet Security (“CIS”) Controls Framework. The CIS Critical Security Controls Framework is a prioritized set of safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are mapped to and referenced by multiple legal, regulatory, and policy frameworks. This framework is employed to guide cybersecurity investments similar to third party audits and risk assessments. Our Cybersecurity Program employs a practical risk-based approach with a focus on addressing risk factors with the highest possible impact, high levels of likelihood, and least amount of existing compensating controls. Key risk factors, along with action plans and a status of identified matters are communicated to Executive Management, the Audit Committee and the Board as part of the CISO's quarterly updates. We have created and continually update, as required, a detailed cybersecurity incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification and which we will implement in the event of a cybersecurity incident, including the determination of materiality of cybersecurity incidents to ensure accurate and timely disclosures of those events in accordance with current regulatory requirements.The Company engages a third party to perform an annual cybersecurity audit, which attests compliance with our Cybersecurity Program and industry best practices. The results of the third-party audit and internal vulnerability reviews are used by the CISO to guide investments in cybersecurity capabilities, solutions, and services to reduce the Company's exposure to cybersecurity risks. To aid managing, prioritizing and remediating any identified cybersecurity, software engineering, and IT infrastructure risks, the Company has implemented a risk register. The risk register is maintained by the IT Department and the status of remediation efforts is communicated to management during the quarterly meetings of the IT Steering Committee. Any significant, control failure, weakness or cybersecurity incident is reported by the CISO to the Company's incident response team and prioritized for remediation in accordance with our cybersecurity incident response plan.In addition to the third-party audit, we perform ongoing vulnerability reviews and conduct annual penetration testing of certain external and internal systems based on selected criteria as determined by Management in conjunction with external consultants. These tests are conducted by qualified external consultants and all findings are reported to the CISO and any deficiency is tracked until it has been fully remediated. A risk assessment is conducted regularly based on NIST and CIS frameworks to determine gaps in controls that exposes the Company to a risk level that requires mitigation