Company: SRFM
Filing Date: 2025-03-21
Form Type: 10-K
Source: 0000950170-25-043326
Chunk: 111

Company: SURF AIR MOBILITY INC.
Filing Date: 2025-03-21
Form: 10-K
Item: Item 1B
Chunk 111
---
None.

ITEM 1C: CYBERSECURITYWe recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have implemented and planned several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

51

As part of our overall approach to managing risks, we have implemented the following: •Cybersecurity incident response plan and procedures   •Change management and software development life cycle (“SDLC”) workflow across the Engineering release team•Role-based access controls across enterprise systems•Work with partners that have SOC1/SOC2 compliance standards around the management and processing of payment card industry (“PCI”) and personally identifiable information (“PII”) data•Use of multi-factor authentication for accessing digital content across important roles in the enterprise•Implementation of security frameworks to guard against business email compromise and device security to protect against malware, ransomware, and other risks across employees’ devices•Device management tools to centrally manage and update company-owned hardware assets•Implementation of vulnerability scanning frameworks across digital and hardware assets across the enterprise Also on our planned roadmap are the below-listed activities:• Undertake regular reviews of our consumer-facing policies and statements related to cybersecurity•Implement cybersecurity management and incident training for employees •Conduct regular phishing email simulations for all employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats•Iterate our internal processes and response plans to calibrate with emerging threats/trends As part of our overall approach to enhance our cybersecurity posture, we plan to regularly engage with assessors, consultants, and other third parties to assess and review our program to help identify areas for continued focus, improvement, and/or compliance. Additionally, we are working towards a comprehensive cybersecurity-specific risk assessment process, which helps identify our cybersecurity threat risks by mapping our processes to standards set by the National Institute of Standards and Technology (“NIST”) and plan to align our digital assets to Center for Internet Security (“CIS”) standards, as well as planned engagement with external entities to penetration test our information systems.As of December 31, 2024, we have not experienced any material cybersecurity incidents and risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. The expenses incurred from cybersecurity incidents, in which our SaaS infrastructure providers were targeted in larger attacks, were immaterial. This includes