Company: KVHI
Filing Date: 2025-03-10
Form Type: 10-K
Source: 0001007587-25-000003
Chunk: 89

Company: KVH INDUSTRIES INC \DE\
Filing Date: 2025-03-10
Form: 10-K
Item: Item 1C
Chunk 89
---
ITEM 1C.Cybersecurity

We have established procedures to assess, identify, and manage material risks from cybersecurity threats and have integrated those procedures into our overall risk management systems and processes.

23

Table of Contents 

We have implemented a written information security program ("WISP") to create administrative, technical and physical safeguards at KVH for the protection of confidential information of KVH and its employees and customers and other third parties. The WISP sets forth our procedures for evaluating our electronic and physical methods of collecting, storing, accessing, using, transmitting, and protecting confidential information, including personal information, as defined by federal and state law. We have utilized the National Institute of Standards and Technology’s Cybersecurity Framework (NIST CSF) as a baseline for the WISP procedures in addition to General Data Protection Regulation (GDPR) standards. In addition to our data privacy policy, the WISP policy defines how sensitive and private data is protected. Under our procedures, we perform an annual risk assessment to identify and prioritize key cybersecurity risks, and we update this assessment when we receive information about material new cybersecurity risks. Once we identify material cybersecurity risks, we seek to identify and implement prevention measures. Current prevention measures include, among other things, to the extent we determine to be appropriate for our information systems in light of our financial, personnel and other resources, restricted physical access, restricted systems access, multi-factor authentication, software solutions such as intrusion detection systems, anti-virus, anti-malware, email filtering and quarantining programs, routine system maintenance and updates, backup and recovery systems, routine employee cybersecurity training and testing, and quarterly internal audits. The measures we take may be inadequate to protect us from cybersecurity risks. See “Item 1A. Risk Factors – Risks related to our dependence on third parties and third-party technology – Cybersecurity breaches could disrupt our operations, expose us to liability, damage our reputation, and require us to incur significant costs or otherwise adversely affect our financial results.”We obtain cybersecurity threat intelligence information from law enforcement reports and our cybersecurity operations providers and communicate this information to relevant stakeholders within the organization. We employ third-party cybersecurity operations providers to monitor cybersecurity events and provide rapid responses to any critical events. In addition, we employ contractual provisions to require our third-party information service providers to implement and maintain appropriate security measures over the information we entrust to them. Because of the relatively small size of our information technology workforce, we have limited internal cybersecurity expertise and monitoring capabilities; accordingly, we seek to augment our internal capabilities by engaging