Company: BWAY
Filing Date: 2025-04-22
Form Type: 20-F
Source: 0001171843-25-002347
Chunk: 200

Company: Brainsway Ltd.
Filing Date: 2025-04-22
Form: 20-F
Item: Item 16K
Chunk 200
---
 any reports of cybersecurity incidents or threats. The audit committee could also be notified of this type of threat to the extent deemed appropriate by our internal auditor, which conducts various risk assessments on our company and issues periodic reports where appropriate.
 
We maintain business continuity, contingency, and recovery plans which may be used in the event of a cybersecurity incident.
 
We leverage the advice of third-party auditors and consultants as needed to help us assess and identify risks from cybersecurity threats and to help manage our risk assessment program. We rely on, and plan to increase our collaboration with, a leading provider of cybersecurity services having operations in the U.S., Israel and the Philippines for various projects and initiatives relating to our company and technology (including with respect to the integration of certain cloud-based capabilities within our proprietary Deep TMS device). This provider offers a wide variety of CISO training, compliance, strategy, governance and other resources and tools which we believe will help us address any future cybersecurity threats that may arise in our dynamic and evolving field.
 
We also have policies and procedures to oversee and identify the risks from cybersecurity threats associated with our use of third-party service providers and vendors. Cybersecurity considerations are taken into account by our Company in its selection of outside vendors, particularly those involved with R&D initiatives such as our efforts to integrate cloud-based capabilities within our proprietary Deep TMS device and our plans with respect to our next generation devices incorporating rotational field technology. Any code relating to the operating systems on our devices, and any off-the-shelf software we wish to integrate into our devices, is vetted to ensure that it meets certain cybersecurity requirements relating, for example, to access limitations and encryption capabilities. Our Head of Software Development requires that subcontractors involved in code writing/development be licensed by or partnered with the world’s leading cloud operator, and personally reviews all code inputs and functional configuration inputs to ensure that it meets various cybersecurity protections such as those relating to access limitations, encryption capabilities and password protection.
 
Furthermore, as part of our routine contracting with customers, our legal department routinely considers whether and to what extent specialized contractual agreements (including, for example, Business Associates Agreements) are warranted or prudent, and/or whether to include specific contractual provisions (including for example, requirements to restrict collection, transmission and storage of and/or to anonymize confidential Patient Health Information pursuant to the Health Insurance Portability and Accountability Act (HIPAA) and/or other similar patient privacy statutes). Inclusion of these contracts and/or clauses, where appropriate, is intended to limit any negative impact that may result from