Company: OFIX
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000950170-25-026066
Chunk: 163

Company: Orthofix Medical Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1B
Chunk 163
---
 reviews our cybersecurity, including information technology ("IT") risks, controls, procedures, and plans to mitigate cybersecurity risks and respond to security incidents. The Audit and Finance Committee receives reports on at least a quarterly basis from the Chief Information Officer and the Vice President, Information Security, on, among other issues, our cyber risks and threats, the status of projects, management’s strategies to strengthen our IT systems, assessments of our security program, third-party assessments and testing, our emerging threat landscape, and the review of our cybersecurity insurance policy. Pursuant to our incident response procedures, material cyber incidents will be reported to the Chair of the Audit and Finance Committee upon a determination of material status. Due to the importance of cybersecurity, the full Board of Directors also receives updates on cybersecurity matters from management at least annually.Management is responsible for our company’s day-to-day risk management activities. Our cybersecurity program is led by our Chief Information Officer, who is responsible for assessing and managing cybersecurity risks. He has 26 years of experience in both military and corporate leadership roles, including 13 years of experience in CIO-level leadership roles, including consulting with major firms, covering technology and security operations responsibility. Our Vice President, Information Security, who reports to our Chief Information Officer, is responsible for cybersecurity program execution, risk management, and oversight of information security staff and consultants. She has 20 years of experience in IT roles, including 14 years in IT leadership roles and 6 years in cybersecurity program execution and oversight of information security. Our Manager, Information Security, who reports to our Vice President, Information Security, is responsible for managing our security analyst and engineering team and is also responsible for the tactical execution of security operations. He has 25 years of experience in IT roles including 15 years of experience in security leadership.  He also has the following certifications: ISC2 CISSP, EC-Council Certified Ethical Hacker ("CEH"), and numerous vendor specific certifications. As cybersecurity risks arise, our Information Security team executes the incident response procedure and communicates the appropriate details to management in alignment with the escalation steps in the procedure. In addition, our Chief Information Officer, Vice President, Information Security, and Manager, Information Security, conduct monthly cybersecurity program status reviews with the Information Security team that includes key performance indicator ("KPI") tracking, risk assessment, escalation actions, and project status.

53

Item 2.	Properties 

We lease or own real property to support our business. The following lists those properties that we believe are material to our business. We believe that our