Company: CDLX
Filing Date: 2025-04-03
Form Type: DEF 14A
Source: 0001666071-25-000046
Chunk: 43

Company: Cardlytics, Inc.
Filing Date: 2025-04-03
Form: DEF 14A
Chunk 43
---
, personnel, reputation and identified critical business objectives.

Based on our assessment process, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate such risks and potential material impacts. We implement measures designed to prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats. We prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as ransomware, theft of IP and interruption of services. The risk management and reduction measures we implement, depending on the computing environment or system, may include the following: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, disaster recovery/business continuity plans and clear desk policies; threat detection and incident response; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards and certifications; credit and background checks on our personnel and contractors; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; continuous monitoring for potential intrusions; vendor risk management program; employee security training; penetration testing; cyber insurance; and a dedicated cybersecurity staff.

We work with third parties from time to time that assist us to identify, assess and manage cybersecurity risks, including professional services firms to conduct SOC 2, Type II assessments, incident response consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms and other vendors that help to identify, assess, or manage cybersecurity risks.

<div align='center'>28</div>

To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as professional services, SaaS platforms, managed services, cloud-based infrastructure, encryption and authentication technology and other functions. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide or the information they process, conducting security assessments, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.

For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, refer to our risk factors under Part 1. Item 1A. "Risk Factors" in the Annual Report on Form