Company: TRUE
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001327318-25-000006
Chunk: 135

Company: TrueCar, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 135
---
 to or disclosure of our data or user data, or other hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business” included within Item 1A of this Annual Report on Form 10-K. In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial.

Cybersecurity Governance

Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. As part of our Board’s overall responsibility for oversight of management’s general risk identification and management activities, our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee review and discuss with management and our auditors the Company’s cybersecurity risks and the steps that management has taken to protect against threats to the Company’s information systems and security and review risk and mitigation steps taken by management related to data privacy.  Members of the Audit Committee also receive cybersecurity updates on a quarterly basis from senior management. This update includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

54

Table of Contents

Our cybersecurity risk management and strategy processes are overseen by leaders from our Software and Infrastructure Engineering, Compliance and Legal teams, including our Director of Cybersecurity and Compliance. These individuals have prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.