Company: TALK
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000950170-25-038107
Chunk: 72

Company: Talkspace, Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1B
Chunk 72
---
None.

38

Table of Contents

Item 1C. CYBERSECURITYRisk Management and StrategyTalkspace recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats as a vital component to the success of our business. We have established policies and processes for assessing, identifying, and managing the material risk from cybersecurity threats which may include, among other things, operational risks; fraud; extortion; harm to our business, employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.We routinely assess material risks from cybersecurity threats, which include unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing therein. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, “Risk Factors,” in this annual report on Form 10-K.We also have a cybersecurity specific risk assessment process, which helps identify residual risk from cybersecurity threats. Our risk assessments include the identification of reasonably foreseeable internal and external information security and cybersecurity risks, the likelihood that such events may occur and the impact or potential damage that could result from such risks. The assessments examine the adequacy of our policies, procedures, systems, and the safeguards in place to manage and mitigate the identified risks. The impact of these assessments is the refinement of existing safeguards and the implementation of new safeguards to improve our cybersecurity protections; reasonably address any identified gaps in existing safeguards; and ensure that we regularly monitor the effectiveness of those safeguards.As part of the above processes, we engage with a third-party to review our information security program and related cybersecurity safeguards to help identify areas for continued focus, improvement, and/or compliance. Along with these third parties we ensure that the appropriate personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their impact and potential mitigations. We have implemented the following activities (among others) to mitigate risk:•Periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems;•Background checks prior to hire; •Encryption of data at rest and in transit;•Logging and event monitoring;•Threat detection to monitor for malicious activity and anomalous behavior;•Malware protection and restricting connections to malicious websites; •Data loss protection mechanisms;•Third party penetration testing and internal vulnerability assessments;•Cybersecurity risk assessments of