Company: SATLW
Filing Date: 2025-03-26
Form Type: 10-K
Source: 0001628280-25-014951
Chunk: 166

Company: Satellogic Inc.
Filing Date: 2025-03-26
Form: 10-K
Item: Item 1C
Chunk 166
---
ITEM 1C. CYBERSECURITY

The strategy followed by our Security Incident Response Team (“SIRT”) for managing material risks from cybersecurity threats is aligned to the National Institute of Standards and Technology’s (“NIST”) Cyber Security Framework 1.1 and its associated references in NIST SP 800-53r5.1.1 and NIST 800-61r2 Guides. The strategy was updated in the fourth quarter of 2023 to support our compliance with the SEC’s Rules on Cybersecurity Disclosure for Public Companies and then it was reviewed in the fourth quarter of 2024 as part of our yearly review cycle and is included in our overall enterprise risk management program.Our Incident Detection and Response (“IDR”) processes and practices include the evaluation of each identified cybersecurity threat event to determine its authenticity and potential impact or whether our systems blocked or mitigated it. Our Incident Response Standard, governed by our Incident Response Policy comprises two separate workflows, both tracked in a ticket system. The first workflow encompasses all events requiring investigation. If an event is confirmed as positive and has caused an impact, a second workflow may be triggered, engaging the Materiality Determination Committee until the incident is reported to the SEC or otherwise determined that there is no material impact.In furtherance of detecting, identifying, classifying and mitigating cybersecurity and other data security threats, we also:•Use MFA based authentication and other cryptographical processes to address identity-based cybersecurity risks. •Use context aware access control processes.•Adopted processes to ensure security in specific remote environments.•Have implemented anti-phishing technologies.•Deploy anti-malware solutions, and have them continuously updated.•Implemented a SIEM system, where we monitor (automatically and otherwise) our networks, systems and users.•Perform periodic network and vulnerability scans of our external and internal networks and systems.•Have an incident detection and response team, with its policies and procedures, to review all events that may be part of a security incident.•Use processes to assess and prioritize risks related to applications and how we use them.•Ensure the asset inventory for relevant system components is kept current and accurate;•Maintain updated network and systems architecture documentation•Periodically engage well known external consultants, where appropriate, to assess, test or otherwise assist with aspects of our security controls.•Provide mandatory training on security and compliance matters to all employees, and some more specific as roles and responsibilities require.•Have defined and periodically updated our information security policies regarding, among others, access and control, networked devices, credentials management, physical security