Company: INVUP
Filing Date: 2025-03-28
Form Type: 10-K
Source: 0001641172-25-001193
Chunk: 1474

Company: Investview, Inc.
Filing Date: 2025-03-28
Form: 10-K
Item: Item 1C
Chunk 1474
---
. We utilize third party tools and techniques to test and enhance
our security controls, perform annual cybersecurity framework assessments, conduct ongoing penetration testing of our systems, and benchmark
against best practices. Our internal audit function provides an independent assessment on the overall operations of our cybersecurity
program and the supporting framework.

Our
cybersecurity team engages and utilizes third-party services as it monitors and actively responds to cybersecurity threats. We utilize
an Endpoint Detection and Response (EDR) platform, an anti-virus application, through which incoming electronic communications are filtered,
and an email security platform which seeks out identifiers in communications that disguise, impersonate, or otherwise misrepresent the
source of the communication. If such a communication is detected, it is subject to quarantine or removal depending on the severity of
issue. Additionally, we use a Security Information and Event Management (SIEM) system, which allows us to store logs off the system of
record to prevent log tampering and provides the cybersecurity team functionality to build alerts on specific use cases that are important
and unique to our business. If our applications fail or our software does not successfully block a malicious electronic communication,
employees are required to notify an immediate supervisor or the cybersecurity team promptly, but in no circumstances later than twenty-four
(24) hours after such occurrence.

24

Upon
detection of a cybersecurity incident and initial intake and validation by our cybersecurity team, our incident response team triages
and evaluates the cybersecurity incident, and, depending on the severity, escalates the incident to management and a cross-functional
working group. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment
and reported to executive management. Determination of what resources are needed to address the incident, prioritizing of response activities,
forming of action plans, and notification of external parties as needed are then undertaken by executive management and the cross-functional
working group, led by our Senior Information Officer (SIO). We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and
our executive management makes the final materiality and disclosure determinations, among other compliance decisions.

Governance

Our
board, Senior Information Officer (“SIO”) and management actively assess the Company’s cybersecurity and data privacy
risk management practices with the goal of being proactive rather than reactive. Our SIO and management regularly review the Company’s
cybersecurity and data privacy risks, including our policies, controls and procedures for identifying, managing and mitigating such risks.
Our SIO provides management with