Company: SKLZ
Filing Date: 2025-11-06
Form Type: 10-K
Source: 0001801661-25-000050
Chunk: 105

Company: Skillz Inc.
Filing Date: 2025-11-06
Form: 10-K
Item: Item 1C
Chunk 105
---
, detect, report, and respond to cybersecurity threats. We also conduct periodic phishing training and follow-up with remedial testing and training as necessary.External Assessments 

Our cybersecurity policies, standards, processes and practices are periodically assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, in 2022, 2023 and 2024 we conducted independent cyber maturity assessments to review our controls against portions of the NIST Cybersecurity Framework. We also have achieved PCI SAQ-A Compliance every year since 2019. The results of significant assessments are reported to management, the Board and Audit Committee. Cybersecurity processes are adjusted, as appropriate, based on the information provided from these assessments. 

Governance

Our Principal Security Engineer (“PSE”) is responsible for the day-to-day assessment and management of our material cybersecurity risks. Since November 2021 until May 2025, the Principal Security Engineer (the “PSE-1”) that served in this role had more than 18 years of experience in various information technology, cybersecurity and systems engineering roles. PSE-1’s previous experience includes building and leading cybersecurity functions at large enterprises, startups, and research and development centers, as well as leading software teams which were acquired by Fortune 50 enterprises. PSE-1 also had expertise in building and designing secure software, scalable and resilient systems, incident response practices, privacy programs and other critical security disciplines and practice areas. The Principal Security Engineer holds a master's degree in physics and systems engineering. Since May 2025, the Company’s Manager of IT (“PSE-2”) has assumed the responsibilities of the Principal Security Engineer role. With more than 18 years of experience in information technology and over 12 years in IT management across technology-driven and interactive entertainment organizations, PSE-2 has frequently led both IT operations and cybersecurity initiatives, often as the sole technical lead. Responsibilities have included securing infrastructure, implementing security controls, and supporting secure business operations.To ensure robust oversight, we are establishing a Security Council, led by our Principal Security Engineer, that is comprised of senior leaders, including our Chief Executive Officer, Controller, Chief Financial Officer, and Interim General Counsel. The Security Council has primary management oversight responsibility for assessing and managing risks related to information security, fraud, vendor oversight, data protection and privacy, and our cybersecurity program, as well as responsibility for management of our information security systems. The Board is