Company: CXDO
Filing Date: 2025-03-04
Form Type: 10-K
Source: 0001654954-25-002287
Chunk: 51

Company: Crexendo, Inc.
Filing Date: 2025-03-04
Form: 10-K
Item: Item 1
Chunk 51
---
. The team makes sure that implemented SOC2 controls are supported by complementing processes and procedures. 

Cybersecurity risk is managed through effective inter-department cooperation towards assessing and remediating risks ranging across corporate IT, software development, software quality process, production network architecture and deployment, and data security/privacy.

Crexendo relies on several third-party vendors and contractors in order to provide products and services to its customers as well as to augment the resource pool. On an annual basis, all significant third-party vendors and subservice organizations are assessed for any applicable cybersecurity or service availability risks. Vendors and contractors with access to sensitive data and/or information are expected to meet certain information security requirements.

Board & Executive Oversight – Executive buy in and support is a must for the success of any cybersecurity program. Crexendo C-suite executives and the Board of Directors have the primary responsibility of overseeing organizational cybersecurity and data privacy/security risk management.

Apart from any incidents that require notification to the top management and the board, an end-of-the-year update is presented by Crexendo security team to the executive management and the board. The update provides an overview of organizational security stature, any experienced incidents, in-flight security/compliance projects, and opportunities for improvement. 

The Board factors in the input towards security and compliance program budget to strike a balance between the expense and corresponding risk.

Risks from Cybersecurity Threats – Crexendo provides products and services within Software as a Service (SaaS) market segment. Specifically, the company provides hosted Unified Communication as a Service (UCaaS), where the customer base is highly sensitive towards privacy, service quality and service availability. 

 27Table of Contents

With the growing number of threats from a combination of bad actors, process lapses, human errors, and third-party vulnerabilities, Crexendo is subject to increasing and evolving cybersecurity threats. 

While, we have a comprehensive cybersecurity and compliance program in place as an effort to counter the threats, and while we have not been subject to any cyberattacks that, individually or in the aggregate, have been material to Crexendo's operations or financial condition, there can be no guarantee that Crexendo will not experience such an incident in the future. 

For more information on the risks from cybersecurity threats that we face, refer to “Risk Factors — Operational Risks — Cyber-attacks impacting our networks or systems could have an adverse effect on our business” in Part I, Item 1A of this Annual Report on Form 10-K. 

ITEM 2. PRO