Company: NXNVW
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001213900-25-023287
Chunk: 0

Company: NEXTNAV INC.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1B
Chunk 0
---
Not applicable.

Item 1C. Cybersecurity.

We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.
 
Cybersecurity Program

Given the importance of cybersecurity to our business,
we maintain a robust cybersecurity program to support
both the effectiveness of our systems and our preparedness for information
security risks. This program includes several safeguards, such as: password
protection; multi-factor authentication; code security standards; continuous monitoring and alerting systems
for internal and external threats using industry leading platforms; regular
evaluations of our cybersecurity program, including periodic internal and
external audits, penetration tests, and incident response simulations; and
industry benchmarking. We also require cybersecurity trainings when onboarding
new employees and contractors, as well as annual cybersecurity awareness
training for our employees and contractors. Our program leverages industry
frameworks, including the National Institute of Standards and Technology (NIST)
Cybersecurity Framework (CSF) to strengthen our program effectiveness and
reduce cybersecurity risks.

We use a risk-based
approach with respect to our use and oversight of third-party service
providers, tailoring processes according to the nature and sensitivity of the
data accessed, processed, or stored by such third-party service provider and
performing additional risk screenings and procedures, as appropriate. We use
several means to assess cyber risks related to our third-party service
providers, including maintaining a vendor code of conduct and vendor
questionnaires, conducting due diligence in connection with onboarding new
vendors and annual due diligence with key third-party vendors. We also seek to
collect and assess cybersecurity audit reports and other supporting
documentation when available and include appropriate security terms in our
contracts where applicable as part of our oversight of third-party providers.
 
Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats

In the event of a cybersecurity incident, we maintain a regularly tested incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain an Incident Response Plan (“IRP”) and business continuity and disaster recovery plans