Company: UP
Filing Date: 2025-04-01
Form Type: PRE 14A
Source: 0001140361-25-011647
Chunk: 94

Company: Wheels Up Experience Inc.
Filing Date: 2025-04-01
Form: PRE 14A
Chunk 94
---
 (continued) The Role of Management in Enterprise Risk Management While the Board oversees enterprise risk management, our management is primarily responsible for day-to-day identification and management of risk. Management, including our risk management director and operations personnel dedicated to flight and pilot safety, actively assesses our risk management practices when developing our business strategy. Wheels Up has established internal processes and internal controls to identify and manage risks, to enhance risk reporting to management and the Board, and to comply with certain regulatory requirements related to our operations. It should be noted that, because of inherent limitations, our disclosure controls and procedures, however well designed and operated, can provide only reasonable, and not absolute, assurance that the objectives of the disclosure controls and procedures are met. In addition, our internal audit staff periodically provide reports to the Audit Committee and the other standing committees regarding certain aspects of our accounting, financial and other operational controls. We also maintain a strong internal compliance program related to our flight and maintenance operations, which promotes compliance with regulatory requirements and enhances the identification, evaluation and management of certain risks related to our operations, including safety. Oversight of Cybersecurity Risks The Board, the Audit Committee and management each actively assess Wheels Up’s cybersecurity and data privacy risk management practices with the goal of being proactive rather than reactive. The Company’s cybersecurity risk management practices are intended to assess, identify and manage risks from threats to the security of our information, systems, products and network. We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. We believe our cybersecurity risk management practices are an important part of our enterprise risk management processes, and must be continuously updated and improved. The Board and the Audit Committee regularly review the Company’s cybersecurity and data privacy risks, including our policies, controls and procedures for identifying, managing and mitigating such risks. Management is responsible for day-to-day monitoring of the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Chief Information Security Officer (“CISO”), who reports to our Chief Digital Officer, has primary oversight of material risks from cybersecurity and data privacy matters. Our CISO supervises a team of cyber risk architects, engineers and managers who actively work to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. We also have a U.S. Data Privacy Officer, who reports to our Chief Legal Officer, and a European Data