Company: CDLX
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001666071-25-000034
Chunk: 74

Company: Cardlytics, Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1C
Chunk 74
---
 of risks from cybersecurity threats.

Our cybersecurity risk management strategy relies on input from management, including the Chief Technology Officer, Chief Legal and Privacy Officer, and Chief Financial Officer, who report to the Chief Executive Officer, as well as the Chief Information Security Officer, to help us understand cybersecurity risks, establish priorities, determine the scope and details of our cybersecurity program and implement it. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees. Our cybersecurity incident response and vulnerability management processes involve management, who participate in our disclosure controls and procedures.Every six months, management discusses cybersecurity risk and reviews our cybersecurity program. Management is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports, and reporting to the board of directors regarding cybersecurity matters.Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing and testing of incident response plans. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.

37

Our board of directors oversees our risk management strategy with respect to cybersecurity risks and threats. The board, through its audit committee, holds regular meetings quarterly to discuss issues including our cybersecurity threats, and has a dedicated agenda during such meetings that are designed to assist the audit committee to exercise its oversight function. The meetings involve presentations and reports from the Chief Information Security Officer and management, including updates on contemporary cybersecurity threats faced by us and steps we are taking to address them.