Company: DERM
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001410578-25-000490
Chunk: 12

Company: Journey Medical Corp
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1C
Chunk 12
---
 likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties’ cybersecurity” in our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.

Cybersecurity GovernanceCybersecurity is an important part of our risk management processes and an area of focus for our management. Our Chief Financial Officer (“CFO”) oversees the leaders from our information security, compliance and legal teams who are responsible for our cybersecurity risk management and strategy processes. Our CFO, together with these individuals, also oversee the work of our third-party consultants. These individuals have significant prior business experience in compliance and risk management. Specifically, our CFO has more than 25 years of experience in all aspects of corporate controllership including managing operating and organizational risk developing, executing and maintaining robust internal control environments, including cybersecurity risk and cash controls as part of several pharmaceutical company operations. Our CFO, as well as our management team, are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to our audit committee and overall board of directors on any appropriate items.Our executive management is responsible for the oversight of risks from cybersecurity threats. Members of our board of directors receive periodic updates from our executive management team regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Any urgent cybersecurity threats are immediately flagged and reported to the board of directors.

​