Company: ACTG
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0000934549-25-000004
Chunk: 125

Company: ACACIA RESEARCH CORP
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1C
Chunk 125
---
ITEM 1C. CYBERSECURITY

Risk Management and StrategyWe have developed and implemented various processes to oversee and manage cybersecurity risks that may impact our business and have integrated this cybersecurity risk management framework into our Company’s broader risk management framework. Managing Material Risks & Integrated Overall Risk ManagementTo manage cybersecurity risk and threats, we have developed and continuously review and update our internal risk controls (“Cyber Risk Controls”), which include administrative, physical, and technical controls and which are aligned to the CIS Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework. The Cyber Risk Controls are in many cases integrated with our other controls, policies, procedures and programs to maximize their effectiveness. Likewise, our internal cybersecurity control group meets regularly to discuss, and review identified cyber threats and risks as well as to conduct cybersecurity threat scenario planning. Identified cybersecurity risks are then further analyzed by other risk management personnel as part of our enterprise risk management process.We also have processes in place to stay informed of and monitor prevention, detection, mitigation, and remediation of cybersecurity risks, including but not limited to: employing appropriate incident prevention and detection software where appropriate; employing industry-standard encryption protocols where appropriate; conducting regular vulnerability scans; applying patches in a timely manner; conducting penetration tests and implementing recommended corrective actions in a 

44

Table of Contents

timely manner; maintaining a well-defined incident response plan and supporting procedures; conducting regular phishing simulations and tabletop exercises; and requiring employees to complete cybersecurity training.Engaging Third Parties on Risk ManagementWe collaborate with vendors, service providers, assessors, auditors, consultants, and other third parties on an as-needed basis to develop secure informational and operational technology systems and protect against cybersecurity threats. For example, we engage third-party security experts to conduct risk assessments and program enhancements, including vulnerability assessments, cybersecurity tabletop exercises, and internal and external penetration tests. Managing Third-Party Cybersecurity RiskWe recognize the potential cybersecurity risks associated with the use of third parties that provide services to us, process information on our behalf, or have access to our informational or operational technology systems, and we have processes in place to oversee and manage these risks. For example, we evaluate third-party service providers’ cybersecurity policies, procedures, and practices annually to ensure sufficiently reasonable security measures are in place. We also seek to mitigate third-party cybersecurity risk through contractual safeguards, and/or regular review of the internal control reports of such third parties and incorporating third-party risk into our incident response plans.Material Impact from Cybersecurity IncidentsWhile we have experienced and will continue to experience varying cyber