Company: TALK
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000950170-25-038107
Chunk: 73

Company: Talkspace, Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1B
Chunk 73
---
 our third-party vendors;•Reviews by internal and external audit of the effectiveness of information security-related internal controls;•Closely monitor emerging data protection laws and implement changes to our processes designed to comply as needed; and•Carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.  

39

Table of Contents

Our incident response plan, as implemented by management, coordinates the activities we take to prepare for, detect, contain, eradicate, and recover from cybersecurity incidents as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan also outlines the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Chief Technology Officer escalates material events, including to the Chief Executive Officer and Board.We require all employees to participate in cybersecurity awareness, privacy, security training annually and provide mechanisms to report potential threats. In addition, we use a third-party phishing awareness vendor to increase employee awareness of cybersecurity threats.Our processes also address cybersecurity threat risks associated with our use of third-party service providers. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers and we continually monitor cybersecurity threat risks identified through such diligence.There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face and how a cybersecurity incident may affect our business strategy, results of operations or financial condition, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incident, have not materially affected our business to date. We can provide no assurances that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. See “Item 1A. Risk Factors” for further information about these risks.Cybersecurity GovernanceCybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, and more frequently as relevant, the Audit Committee receives an overview from management covering topics such as security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Audit Committee are also encouraged to regularly engage