Company: HROW
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001641172-25-000925
Chunk: 2424

Company: HARROW, INC.
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1C
Chunk 2424
---
 frequently as determined to be necessary or advisable. Updates to the Audit Committee
include policies, processes, procedures and any significant developments related to the identification, mitigation and remediation of
cybersecurity risks, as well as effectiveness and changes in our ability to monitor, protect, detect and respond to incidents, risk reviews
and industry news briefings. The Audit Committee also ensures that management provides a cyber and information security update to the
Board of Directors at least annually. Finally, in the event a material cybersecurity incident were to occur, the CEO and Vice President
of Information Technology would brief the Audit Committee which would then be responsible for assessing the materiality of the incident
and making the determination of materiality and any related disclosure.

We
face a number of cybersecurity risks in connection with our business. Although we have numerous controls to protect against common attacks,
some attacks may still be effective. Our controls are designed to detect, triage and eradicate these attacks. While we carry a cyber
insurance policy to help cover investigation and mitigation expenses, it may be subject to limitations and be insufficient to cover all
expenses that may result from a cybersecurity incident. Although the risks from cybersecurity threats, including as a result of any previous
cybersecurity incidents, have not materially affected or are reasonably likely to materially affect us, including our business strategy,
results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue
to increase in frequency and sophistication.

 52 

In November
2024, we became aware of a cybersecurity incident that involved unauthorized access of an employee’s email account. Through this
unauthorized access the threat actor was able to fraudulently divert Company funds to its bank account. We detected the incident in a
timeframe management believes minimized any financial, operational or reputational risk to the Company. We believe this early detection
ultimately resulted in an immaterial impact to our financial results and at no point was our ability to generate revenues disrupted.

For
more information about the cybersecurity risks and other information technology and data privacy risks we face, see Item 1A. Risk
Factors and the subsection titled A breakdown of our information technology systems, or a cyberattack or information
security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems,
network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.

ITEM 2. PROPERTIES

We lease approximately 17,700
square feet of office space