Company: NOTV
Filing Date: 2025-12-05
Form Type: 10-K
Source: 0001628280-25-055483
Chunk: 265

Company: Inotiv, Inc.
Filing Date: 2025-12-05
Form: 10-K
Item: Item 1
Chunk 265
---
 critical systems that handle confidential data, we conduct annual third-party security reviews to evaluate and mitigate potential risks. These reviews include a multifaceted approach combining security questionnaires, in-depth manual assessments of vendor security practices, and automated rating systems to assess vendors' cybersecurity postures. We also maintain an incident response plan that coordinates internal teams and third-party providers to triage, investigate, escalate, contain, remediate and recover from incidents, and to meet applicable legal and contractual obligations. The forensic investigation of the 2025 Cybersecurity Incident is complete and determined that between approximately August 5-8, 2025, a threat actor gained unauthorized access to the Company’s systems and may have acquired certain data. While we have identified the likely scope of the incident, the full operational and financial impacts are still being evaluated. Accordingly, we have not yet determined whether the 2025 Cybersecurity Incident is reasonably likely to have a material impact on the Company. Further, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors – Risks Related to Technology and Cybersecurity.

Governance of Cybersecurity ManagementOur cybersecurity governance structure is specifically designed to provide a clear chain of responsibility and accountability for assessing, managing, and mitigating cybersecurity risks. The Vice President of Information Security, who reports directly to the Chief Technology Officer ("CTO"), a member of our Executive Committee, leads our cybersecurity initiatives. Together, the Vice President of Information Security and the CTO bring a combined 50 years of technology experience with over 20 years dedicated to IT and security leadership. The Vice President of Information Security is tasked with overseeing cybersecurity risk assessments, implementing strategic security initiatives, and ensuring alignment with evolving regulatory requirements. The Vice President of Information Security provides weekly briefings to the CTO. Additionally, the Vice President of Information Security presents updates to the Executive Committee and the Board of Directors at least annually, although these updates generally occur on a quarterly basis. These presentations cover critical security issues and significant emerging threats.

40

The Board of Directors, through its Audit Committee, is responsible for the oversight of Inotiv’s cybersecurity risk management practices. The Audit Committee reviews and assesses our approach to risk management, including risk associated with cybersecurity, against industry standards and regulatory obligations. We believe this governance structure is integral to maintaining high-level visibility and accountability across all levels of leadership. By providing the Board of Directors with regular and detailed updates on cybersecurity initiatives