Company: INVUP
Filing Date: 2025-03-28
Form Type: 10-K
Source: 0001641172-25-001193
Chunk: 1365

Company: Investview, Inc.
Filing Date: 2025-03-28
Form: 10-K
Item: Item 1B
Chunk 1365
---
None.

Item
1C. CYBERSECURITY

Risk
Management and Strategy

The
Company’s cybersecurity risk management practices are intended to assess, identify and manage risks from threats to the security
of our information, systems, products and network. Our cybersecurity program is a key component of our broader risk management strategy
in which cyber risk has been identified and is actively managed with preventive and mitigating measures. We design and assess our cybersecurity
program based on the National Institute of Standards and Technology’s Cybersecurity Framework, ISO 27001, and industry-specific
regulations. This does not imply that we meet any particular technical standards, specifications or requirements, but rather that we
use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

Cybersecurity
incidents could result from unintentional events, or from deliberate attacks by unauthorized entities or individuals attempting to gain
access to Investview’s System Technology for the purposes of misappropriating assets or information or causing operational disruption
and damage. To mitigate the risk of an impact to our business operations and/or damage from cybersecurity incidents or cyberattacks,
Investview invests in multiple forms of cybersecurity and operational safeguards.

On
an ongoing basis, we assess our people, processes, and technology, and when necessary, modify the overall program in order to meet the
demands of the ever-changing cyber risk environment. As part of our regular training and readiness program, we conduct phishing and penetration
testing campaigns in order to ensure that our employees are familiar with all types of phishing emails and similar threats.

Our
data is dynamically backed up to mitigate against data loss. To prevent unauthorized access and data breaches, we encrypt sensitive data
both in transit and at rest. We have also implemented access controls and multi-factor authentication to ensure that only authorized
personnel can access sensitive information. We also utilize third-party information technology systems vendors to conduct regular network
and endpoint monitoring.

Our
risk management program is comprised of, among other things, policies that are designed to identify, assess, manage, and mitigate cybersecurity
risk, and is based on applicable laws and regulations, derived from industry standards and best practices. These policies are intended
to identify cybersecurity threats that may be associated with both internally managed systems and systems managed by third-party service
providers.

We
conduct risk assessments to evaluate the effectiveness of our systems and processes in addressing threats and to identify opportunities
for enhancements. Additionally, we conduct privacy and cybersecurity reviews, as well as annual employee training, and monitor