Company: VREOF
Filing Date: 2025-03-04
Form Type: 10-K
Source: 0001558370-25-002130
Chunk: 18

Company: Vireo Growth Inc.
Filing Date: 2025-03-04
Form: 10-K
Item: Item 1C
Chunk 18
---
Item 1C.Cybersecurity

Cybersecurity risk management and strategy​The Company integrates risk management into its overall cybersecurity strategy and has implemented processes designed to identify, assess, prioritize, and manage risks to protect data, intellectual property, and information assets. As part of our risk governance and management, the Company has developed procedures to identify and evaluate risks, measure them against predefined criteria, devise and execute strategies to mitigate identified risks, continuously monitor and review risk profiles, and communicate risks to management and relevant stakeholders. Addressing cybersecurity risks involves a comprehensive approach that encompasses both internal assessments and external information sources. For instance, the Company engages in security assessments conducted by internal and external experts to ensure compliance with security policies and industry frameworks; and vulnerability assessments to discover vulnerabilities in networks, systems and applications. The Company has strategically reduced its hardware footprint by eliminating on-premise datacenters and moving IT infrastructure into cloud-hosted and Software as a Service (SaaS) providers. As a result, the Company believes it is streamlined and agile to respond quickly to market fluctuations and changes in the industry. Additionally, the Company leverages cloud-hosted and SaaS providers that offer Service Level Agreements (SLAs) and adhere to compliance and regulatory requirements for the industry. We oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk. The Company performs ongoing risk assessments that evaluate IT systems and assess the likelihood of occurrence, estimate potential impact, and plan for remediation.

​

Cybersecurity Governance​Cybersecurity risk management is overseen by the Company’s Vice President of Information Technology and Security who is supported by full-time information security staff. These individuals have experience across industries that, among other things, develops and distributes information security policies, standards and procedures; engages in employee cybersecurity training; implements security controls; assesses security risk and compliance posture; monitors and responds to security events; and executes security testing and assessments The Vice President of Information Technology and Security advises the executive team on the development and implementation of the information security program.​The Company incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, the Company has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see “