Company: BWAY
Filing Date: 2025-04-22
Form Type: 20-F
Source: 0001171843-25-002347
Chunk: 199

Company: Brainsway Ltd.
Filing Date: 2025-04-22
Form: 20-F
Item: Item 16K
Chunk 199
---
ITEM 16K. CYBERSECURITY
 
We operate in the medical device sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to protect information we may have on our employees, vendors, and in some cases (for example, in our clinical trial data sets) patients, as well as to prevent data loss and other security breaches.
 
Our current cybersecurity risk assessment and protection program consists of various cybersecurity software features and capabilities designed to protect our systems and alert us of any cybersecurity incidents, such as software to strengthen protection against targeted attacks and previously unknown exploits, a network intrusion detection system, firewall and router features enabling unified threat management, load balancing, multi Wide Area Network (WAN) and various measures which limit the ability of different sectors within our organization to access certain types of information.
 

 151 
-----
 

In the event of a cybersecurity incident or threat, our Information Technology (IT) personnel and/or other personnel alert our Quality Assurance (QA) team and/or appropriate members of our Research and Development (R&D) team such as our Head of Software Development. Our QA manager previously served as a Medical Devices lead auditor for the Israel Standards Institute and has over 20 years of overall QA and project management experience including with respect to managing QA systems, regulatory affairs, supporting engineering and production processes, and involvement in corrective and preventive actions (CAPA).
 
Our Head of Software Development previously served as a conditional access engineer (a key function in cybersecurity compliance) and a technical program manager for large cyber-focused programs, and periodically attends cybersecurity workshops.
 
These departments/individuals and/or their teams are responsible for the day-to-day assessment and management of risks arising from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents.
 
In the event of a material incident or threat, our CEO is notified as well. The CEO would then be expected to report the threat to the audit committee of the Board of Directors, which is responsible for oversight of strategic, financial and other major risks to the Company, which could include those posed by cybersecurity threats. This would include reviewing any cybersecurity measures taken by the IT team and