Company: HCTI
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001213900-25-026218
Chunk: 286

Company: Healthcare Triangle, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1B
Chunk 286
---
Item 1B. Unresolved Staff Comments

None

Item 1C. Cybersecurity

HCTI employs a multilayer approach to addressing
cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a dedicated cybersecurity
team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify
potential cyber threats. External third party security firms are engaged to assist with cybersecurity risk assessments, penetration testing
and system security analysis. HCTI’s cybersecurity team works in conjunction with the risk management, legal, finance, accounting,
operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. To
ensure consistency, these cybersecurity risk assessments are incorporated into HCTI’s Enterprise Risk Management process, HCTI’s
information technology leadership reviews the company’s enterprise risk management-level cybersecurity risks on a quarterly basis,
and key cybersecurity risks are incorporated into HCTI’s enterprise risk management framework. Cybersecurity risks are managed and
controlled through multiple overlapping layers of cybersecurity defenses that include:

    ●
    expert input from both public and private partnerships;

    ●
    the implementation of a comprehensive cybersecurity policy that encompasses but is not limited to social media, acceptable use (devices, wireless, remote access, internet use), information governance, monitoring, authentication, encryption, vulnerability management, third-party management, and recovery;

    ●
    required annual cybersecurity training for all employees with additional supplemental cybersecurity training required based on role;

    ●
    random employee phish testing and follow-up;

    ●
    procedural and automated cyber controls in conjunction with robust detection, mitigation, and recovery capabilities;

    ●
    the formation of a multidisciplinary cybersecurity incident response team;

    ●
    the integration of multiple threat intelligence sources into our cybersecurity tools and processes;

    ●
    the retention of external cybersecurity threat response resources;

    ●
    the formation of a multidisciplinary cybersecurity incident response team; and

    ●
    multiple cyber event simulation and tabletop exercises per year to hone the cybersecurity incident response team preparedness.

The HCTI board of directors provides enterprise-level
oversight of risks associated with cybersecurity threats through the Audit Committee, which assists the Board in fulfilling its oversight
responsibilities regarding the Company’s policies and processes with respect to risk assessment and risk management, including any
significant non-financial risk exposures; reviewing and discussing the Company’s information security policies and internal controls
regarding information security; and