Company: STAA
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000950170-25-024813
Chunk: 137

Company: STAAR SURGICAL CO
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 137
---
Risk Management and Strategy

We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these processes into our overall risk management program. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. 

We have adopted as the governance framework for our cybersecurity program the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). We use this framework as a guide to help us identify, assess, respond to, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program includes:

•periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology (IT) environment;

•skilled internal information security (IS) and data privacy personnel, who support our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents;

•external service providers, where appropriate, to monitor, assess, test, or otherwise assist with aspects of our security controls, and to support risk mitigation efforts; 

•training for our employees on cybersecurity awareness and the importance of protecting information assets, including “phishing” tests;

•periodic reviews of key cybersecurity policies, and updating as needed;

•information governance policy and a cybersecurity incident response plan that includes procedures for monitoring data use and responding to cybersecurity incidents; and

•a third-party risk management process for service providers, suppliers, and vendors.

Based on the information available to us as of the date of this Annual Report, we believe that risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, and as of the date of this Annual Report, we are not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

Governance

Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity, including data security risk mitigation efforts, to the Audit Committee. Under the Audit Committee charter, the Audit Committee has responsibility for discussing with management the Company’s policies with