Company: IIIV
Filing Date: 2025-01-10
Form Type: DEF 14A
Source: 0001728688-25-000006
Chunk: 11

Company: i3 Verticals, Inc.
Filing Date: 2025-01-10
Form: DEF 14A
Chunk 11
---
 and the Nominating and Corporate Governance Committee, each of which addresses risks specific to its respective areas of oversight. In particular, the Audit Committee has the responsibility to consider and discuss with management our major financial risk exposures and the steps our management has taken to monitor and control these exposures, including creating guidelines and policies to govern the process by which risk assessment and management is undertaken. The Audit Committee also monitors compliance with legal and regulatory requirements. Moreover, the Audit Committee is responsible for the oversight of the Company’s privacy, data and cybersecurity risk exposures, including the steps management has taken to monitor and mitigate such exposures and protect against threats to the Company’s information systems and security. Our Compensation Committee assesses and monitors whether any of our compensation policies and programs have the potential to encourage excessive risk-taking. Our Nominating and Corporate Governance Committee assists with risk oversight by managing the structure and organization of our Board of Directors, the criteria for selecting new members to the Board of Directors and any committees of the Board of Directors, determining compensation for directors, evaluating members of the Board of Directors, and annually reviewing the corporate governance principles of the Company and recommending changes when appropriate.

Cybersecurity risk oversight is a priority for the Board and our management. Our cybersecurity team deploys an array of capabilities to ensure the availability, integrity and confidentiality of our key business systems. Key aspects of our cyber security risk management program include the following:

• Our Chief Technology Officer, who leads our cybersecurity risk management program at a management level, reports to the Audit Committee of our Board of Directors on a quarterly basis regarding cybersecurity matters.

• We routinely invest in protecting, monitoring, alerting and mitigating cybersecurity risks across our business, and maintain a cybersecurity insurance policy.

• We have a comprehensive cybersecurity and privacy program based on industry standard guidelines and regulations such as National Institute of Standards and Technology (“NIST”), Center for Internet Security (“CIS”), Cloud Service Alliance (“CSA”) and Payment Card Industry (“PCI”), and relevant privacy regulations and implement risk based technical, administrative and organizational measures designed to protect the availability, integrity and confidentiality of our data.

• We provide new hire and annual security awareness and privacy training to all employees, and conduct phishing assessment exercises to ensure employees are aware and educated about phishing threats and are trained to identify and report them.

• We utilize external and internal resources performing assessments and penetration testing throughout the year on the Company’s key business systems, including an annual review to verify our compliance with the Payment Card Industries Data Security Standards (PCI DSS).

• We have an incident response