Company: UP
Filing Date: 2025-03-11
Form Type: 10-K
Source: 0001819516-25-000012
Chunk: 92

Company: Wheels Up Experience Inc.
Filing Date: 2025-03-11
Form: 10-K
Item: Item 1C
Chunk 92
---
 We also seek contractual commitments from third parties to satisfy our cybersecurity and data privacy requirements, and require third parties to maintain their information technology systems and protect Wheels Up information that is processed on their systems.•Third-party assessments of Wheels Up: We have engaged third-party cybersecurity companies to periodically assess our cybersecurity and data privacy processes and procedures, and to assist in identifying and remediating risks from cybersecurity threats. Our third-party assessors regularly conduct penetration testing and measure our processes, procedures and responses against industry standard frameworks. We use 

44

the results of these periodic assessments to implement programmatic changes and continuous improvements in alignment with business requirements, industry standards and regulatory requirements.We believe our cybersecurity risk management practices are an important part of our enterprise risk management processes, which must be continuously updated and improved.  As of the date of this Annual Report, we have not identified risks from cybersecurity threats, including as a result of any past cybersecurity incidents, since the beginning of the last full fiscal year that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.  See the caption titled “Risks Relating to Technology, Cybersecurity and Data Privacy” in Part I, Item 1A “Risk Factors” in this Annual Report for more information about cybersecurity and data privacy risks.

Governance

The Board, the Audit Committee and management each actively assess the Company’s cybersecurity and data privacy risk management practices with the goal of being proactive rather than reactive.  The Board and the Audit Committee regularly review the Company’s cybersecurity and data privacy risks, including our policies, controls and procedures for identifying, managing and mitigating such risks. The Audit Committee receives periodic reports from our Chief Information Security Officer (“CISO”) and other members of management, to the extent their relevant areas are impacted, regarding cybersecurity and data privacy measures and procedures, the identification of security gaps and compliance with applicable cybersecurity and data privacy regulations.  The Audit Committee then briefs the Board at scheduled meetings about cybersecurity and data privacy developments.

Management is responsible for day-to-day monitoring of the prevention, detection, mitigation and remediation of cybersecurity incidents.  Our CISO, who reports to our Chief Digital Officer, has primary oversight of material risks from cybersecurity threats. Our CISO has more than 25 years of experience across various information technology, information security and management roles, including leading the development and implementation of cybersecurity and data privacy strategies for the member and customer-facing aspects of our business. In addition, our CISO holds degrees in Engineering Technology and Information