Company: SPWH
Filing Date: 2025-04-02
Form Type: 10-K
Source: 0000950170-25-048890
Chunk: 224

Company: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.
Filing Date: 2025-04-02
Form: 10-K
Item: Item 1B
Chunk 224
---
CIO”) and supported by our Director of Information Security and Compliance, (collectively, “Security Team”), help identify, assess and manage the Company’s cybersecurity threats and risks. The Security Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated tools in certain environments and systems, internal and external audits of certain environments and systems, conducting scans of certain threat environments, evaluating our and our industry’s risk profile, analyzing certain reports of threats and actors, conducting threat assessments for internal and external threats (including third party threat assessments) in certain environments, coordinating with law enforcement concerning select threats, subscribing to reports and services that identify cybersecurity threats, use of external intelligence feeds, conducting tabletop incident response exercises, evaluating certain threats reported to us, and conducting vulnerability assessments of certain environments and systems.Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident response policy, vulnerability management policy, risk assessments, encryption of certain data, network security controls and data segregation for certain environments and systems, access controls for certain environments and systems (such as identity controls and quarterly user access reviews), physical security, systems monitoring for certain systems, vendor risk management program, system configuration standards, outfitter security awareness training, asset management,  managed detection and response tools, penetration testing, cybersecurity insurance and dedicated cybersecurity staff.

39

Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes.  For example, the Security Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including, for example: professional service firms including legal counsel, threat intelligence service providers, cybersecurity consultants, 24/7 cybersecurity monitoring software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services and forensic investigators, managed detection and response providers, and external threat hunting partners.We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies and application providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers.  The program includes a risk assessment and security questionnaire for certain providers, review of security assessments for certain providers