Company: PERI
Filing Date: 2025-03-25
Form Type: 20-F
Source: 0001178913-25-001021
Chunk: 151

Company: Perion Network Ltd.
Filing Date: 2025-03-25
Form: 20-F
Item: Item 16K
Chunk 151
---

ITEM                CYBERSECURITY             
16K.   RISK MANAGEMENT POLICIES AND PROCEDURES
----------------------------------------------
   Cybersecurity Risk Management and Strategy
 
 We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems, networks, and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and cybersecurity controls.  Our cybersecurity risk management program is assessed annually by independent third-party auditors. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes.

Our cybersecurity risk management program includes:
 

•                                                         risk assessments designed                                                      
    to help identify, manage and address material cybersecurity risks to our critical systems, networks, information, products, services,
                                          and broader enterprise information technology environment;                                     
-----------------------------------------------------------------------------------------------------------------------------------------

•                                                         a cybersecurity management                                                      
    team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our cybersecurity controls, and (3) our
                                               response to cybersecurity threats and incidents;                                           
------------------------------------------------------------------------------------------------------------------------------------------

•                                                          the                                                       
                                                    use of third-party                                               
    service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;
---------------------------------------------------------------------------------------------------------------------

•                    a risk management process                  
    for third-party service providers and suppliers and vendors;
----------------------------------------------------------------

•                                cybersecurity awareness                              
    training of our employees, incident response personnel, and senior management; and
--------------------------------------------------------------------------------------

•                                      a cybersecurity incident                                  
    response plan that includes procedures for responding to cybersecurity threats and incidents.
-------------------------------------------------------------------------------------------------
 
With respect to our third-party risk management processes, we generally seek to impose certain cybersecurity requirements on critical third parties with whom we do business. Although we employ third-party due diligence, onboarding, and other procedures designed to assess the data protection, data privacy, and cybersecurity practices of third-party service providers, suppliers and vendors (including risk assessments and contractual protections), our ability to monitor such practices is limited, we do not control their cyber risk management and there can be no assurance that we will detect, prevent, mitigate, or remediate the risk of any weakness, compromise, or failure in the systems, networks, and information owned or controlled by such third parties. When we do become aware that a third-party service provider, supplier, or vendor has experienced any compromise or failure, we attempt to mitigate our risk, which may include termination of such third party’s connections to our systems, networks and information where we deem it to be appropriate