Company: GOLD
Filing Date: 2025-09-11
Form Type: 10-K
Source: 0001193125-25-200462
Chunk: 9

Company: Gold.com, Inc.
Filing Date: 2025-09-11
Form: 10-K
Item: Item 1C
Chunk 9
---
Cybersecurity Risk Management and Strategy

We recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of company information and the personal information that we process. Cybersecurity risk management is an integral part of our overall enterprise risk management efforts. We manage cybersecurity risks using a framework based on applicable regulations, industry standards, and recognized best practices. Through this framework, we devote significant resources to identifying, monitoring, assessing, and responding to cybersecurity threats and incidents, including those associated with our use of third-party software, applications, services, and cloud infrastructure.

Our Cybersecurity Program includes multiple policies, procedures, and other components designed to identify, analyze, and respond to cybersecurity risks, including reliance on a layered system of preventative and detective technologies and controls designed to detect, mitigate, and contain cybersecurity threats. As part of our Cybersecurity Program, we maintain a Written Information Security Plan that outlines internal controls and procedures designed to protect our information systems. Our Cybersecurity Program contains a comprehensive suite of cybersecurity policies that are commensurate with companies in our industry of similar size and sophistication, and these policies are also informed by the sensitivity of our data processing activities. Our Cybersecurity Program also includes policies and procedures designed to ensure adequate business continuity, disaster recovery, and incident response. We also have access through our insurer to computer forensics firms and specialized legal counsel in case of a cybersecurity incident. While we maintain cybersecurity insurance to assist in the cost of recovery from a cybersecurity incident, such coverage may not be sufficient to cover all costs resulting from such incidents.

We leverage qualified third-party consultants, advisors, counsel, and other experts to inform, audit, and update our Cybersecurity Program throughout each year. We engage security assessors to identify vulnerabilities through both internal and external penetration tests and to perform cybersecurity maturity assessments. We perform risk assessments annually, or more frequently if circumstances require, using both internal and external resources. We may also be subject to examinations or disclosures by applicable regulators. We conduct annual cybersecurity training for employees to enhance awareness of how to detect and respond to cybersecurity threats, as well as periodic phishing training and testing campaigns. We also conduct periodic table-top exercises to simulate a response to a cybersecurity incident.

Our designated IT team members monitor cybersecurity threats in real time for the Company at the enterprise level, with the assistance of third-party threat detection and monitoring software. Cybersecurity threats at the subsidiary level are also monitored in real time by experienced IT professionals at those subsidiaries, including our IT leadership at JM Bullion, AMS, Pinehurst, LPM,