Company: INGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029993
Chunk: 39

Company: Inogen Inc
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1B
Chunk 39
---
 security breaches, but this insurance is limited in amount, subject to a deductible, and may not be adequate to cover us for all costs arising from these incidents.

 56

Use of Consultants and Advisors: We engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with protection and monitoring of our systems and information, including with respect to, network monitoring, endpoint protection, vulnerability assessments and penetration testing. We engage cybersecurity consultants, auditors, and other third parties to assess and enhance our cybersecurity practices, such as a third-party consulting firm to evaluate our cyber processes including an assessment of our incident response procedures. We have processes to evaluate third-party service providers and vendors that have access to sensitive systems and company and customer data, which may include due diligence procedures such as assessments of that service provider’s cybersecurity posture or a recommendation of specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.Board Oversight and Management’s Role: The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. All of the Audit Committee members are independent directors. In particular, the Audit Committee assists the Board in its oversight of management’s responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data. Management has implemented risk management structures, policies and procedures, and Management is responsible for our day-to-day cybersecurity risk management. Our Chief Data and Information Officer, or CDIO, is responsible for our day-to-day assessment and management of cybersecurity risks. Our Enterprise Enablement function facilitates a cross-departmental approach, ensuring the executive leadership team receives quarterly updates on cybersecurity from various teams. This strategy promotes a comprehensive stakeholder engagement and enhances management oversight on cybersecurity. The updates cover progress on ongoing cybersecurity initiatives, insights from any potential threats or incidents, outputs and action plans from external vulnerability and penetration tests, and key performance metrics in line with industry standards.Risks from Material Cybersecurity Threats: Despite ongoing threats like cyber-attacks, phishing, and ransomware, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Our