Company: CDLX
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001666071-25-000034
Chunk: 73

Company: Cardlytics, Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1C
Chunk 73
---
 computing environment or system, may include the following: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, disaster recovery/business continuity plans and clear desk policies; threat detection and incident response; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards and certifications; credit and background checks on our personnel and contractors; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; continuous monitoring for potential intrusions; vendor risk management program; employee security training; penetration testing; cyber insurance; and a dedicated cybersecurity staff and officer.We work with third parties from time to time that assist us to identify, assess and manage cybersecurity risks, including professional services firms to conduct SOC 2, Type II assessments, incident response consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms and other vendors that help to identify, assess, or manage cybersecurity risks.To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as professional services, SaaS platforms, managed services, cloud-based infrastructure, encryption and authentication technology and other functions. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide or the information they process, conducting security assessments, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, refer to our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report, including "An actual or perceived breach of the security of our systems, or those of third parties with whom we work, could result in adverse consequences resulting from such breach, including but not limited to a disruption of our operations, reputational harm, loss of revenue or profits, loss of customers, regulatory investigations or actions, litigation, fines and penalties and other adverse consequences."

Governance

Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors along with the audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation