Company: CLSKW
Filing Date: 2025-11-25
Form Type: 10-K
Source: 0001193125-25-297510
Chunk: 6

Company: CLEANSPARK, INC.
Filing Date: 2025-11-25
Form: 10-K
Item: Item 1C
Chunk 6
---
Cybersecurity risk may adversely impact our business. The impact could include weakened financial condition, litigation risk, degrading mining operations, loss of competitiveness, fraud, extortion, harm to employees, violation of applicable privacy or other regulations that could result in regulatory action and fines.

Risk Management and Strategy

We maintain a cybersecurity program to manage the confidentiality, integrity and availability of our data and information systems that support our business. The program is aligned with the National Institute of Standards and Technology Cybersecurity Framework 2.0 and is integrated into our overall risk management program. It is designed to develop appropriate strategies for preserving the confidentiality, integrity and availability of our data and information systems that can evolve with the changing cybersecurity threat landscape. We have implemented policies, procedures and technological tools to prevent, detect and mitigate cybersecurity risks posed by third parties.

We use third-party security vendors to further strengthen our cybersecurity posture. These partners provide advanced monitoring, detection, and response capabilities that complement our internal controls and staff expertise. Their services include continuous threat intelligence, vulnerability management, and incident response support, which are integrated into our cybersecurity program. A written cybersecurity incident response plan that we tabletop yearly and cybersecurity insurance are also key components of our approach to managing the risk of a cyber event. Our incident response plan contains a materiality analysis framework based on Federal Information Processing Standards Publication 199. This materiality framework allows us to identify and classify cybersecurity events based on their impact to our data or information systems. This framework will assist us in expediting review of cyber events for materiality purposes that could require disclosure to the SEC.

We have implemented a third-party risk management policy that categorizes the cybersecurity risk posed by third party vendors along with the type of cybersecurity controls we may require of those vendors. These may include employee training, cybersecurity tools like multi-factor authentication, and contractual requirements that vendors maintain appropriate technical, administrative and physical cybersecurity controls. This is in addition to the policies and practices we maintain to monitor access of our information systems and data using our internal staff and third-party vendors. As part of communicating the importance of cybersecurity at an enterprise-wide level, we require that all company employees participate in annual cybersecurity training.