Company: XAIR
Filing Date: 2025-06-20
Form Type: 10-K
Source: 0001641172-25-015750
Chunk: 948

Company: Beyond Air, Inc.
Filing Date: 2025-06-20
Form: 10-K
Item: Item 1B
Chunk 948
---
 our cybersecurity program, including periodic internal and external audits, penetration tests, and incident
response simulations. We also require cybersecurity training when onboarding new employees and contractors, as well as required cybersecurity
awareness training for our employees and contractors/other workforce members. Our program leverages industry frameworks, including the
National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce
cybersecurity risks.

We
use a risk-based approach with respect to our use and oversight of third-party service providers. We use a number of means to assess cyber
risks related to our third-party service providers, including maintaining vendor questionnaires/conducting due diligence in connection
with onboarding new vendors and engaging in periodic reviews thereafter as appropriate.

Process
for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats 

In
the event of a cybersecurity incident, we maintain a regularly tested incident response program. Pursuant to the program and its escalation
protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, and handling it in accordance
with that severity level. We have relationships with a number of third-party service providers to assist with cybersecurity containment
and remediation efforts.

Governance

Upon
a notification of concerning factors which may be indicative that a notable cybersecurity incident has occurred, the Cyber Security Subcommittee
(Cyber Security Subcommittee) consisting of General Counsel, Head of HR & Chief Technical Officer (CTO) meets to make an initial assessment.
If the Cyber Security Subcommittee determines there is a reasonable likelihood a notable cybersecurity incident has occurred, then notice
will promptly be given to certain members of the Company Executive Team including our Chief Executive Officer, Chief Operating Officer,
Chief Commercial Officer & Chief Financial Officer.

Our
team leverages over 25 years of experience in various cyber security functions. Our CTO, and their team, are responsible for the day-to-day
management of the cybersecurity program.

73

The
CTO provides periodic briefings for our senior management team on cybersecurity matters, including the prevention, detection, mitigation,
and remediation of cybersecurity incidents and cybersecurity threats.

Board
Oversight

While
the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit
Committee is responsible for reviewing, discussing with management, and overseeing the Company’s cybersecurity and privacy risk
exposures and policies. On a quarterly basis, the CTO reports to the Audit Committee on information technology and