Company: SIDU
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001641172-25-001742
Chunk: 203

Company: Sidus Space Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1B
Chunk 203
---
None.

ITEM 1C. CYBERSECURITY

We believe cybersecurity
is critical to advancing our technological developments. As a U.S. commercial space company with an established manufacturing business,
we face a multitude of cybersecurity threats common to most industries, such as ransomware and denial-of service. Our customers, suppliers,
subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities
could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related
risks make it imperative that we expend resources on cybersecurity.

Risk Management

We engage third-party services
to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices
to address new challenges. We have established cybersecurity security awareness training and ongoing monitoring.

In the event of an incident,
we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation,
and notification. We contract with external firms that have extensive information technology and program management experience. We have
implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a commercial space company,
we must comply with extensive regulations, including requirements imposed by the Department of Defense related to contracts with government
agencies and reporting cybersecurity incidents to the SEC. In addition to following SEC guidance and implementing pre-existing third
party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity
risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily
on our supply chain to deliver our products and services, and a cybersecurity incident at a subcontractor, or business partner could
materially adversely impact us. We require that our subcontractors report cybersecurity incidents to our IT Incident Response Coordinator
who will investigate the direct impact of the incident. Once a potential incident has been confirmed, the Incident Response Coordinator
will notify senior management that activation of the incident response plan is required and assign a severity rating, ranging from none
to critical, based on the perceived impact.

Governance

The Audit Committee has
oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements,
cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations,
as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise,
any