Company: NOTV
Filing Date: 2025-12-05
Form Type: 10-K
Source: 0001628280-25-055483
Chunk: 32

Company: Inotiv, Inc.
Filing Date: 2025-12-05
Form: 10-K
Item: Item 1C
Chunk 32
---
ITEM 1C - CYBERSECURITY

Cybersecurity Risk Management and StrategyInotiv’s cybersecurity risk management framework is grounded in external standards, specifically those of the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS). These guidelines provide a strong, structured foundation designed to systematically protect business operations, customer data, and intellectual property in an environment of rapidly evolving cyber threats. We deploy a multifaceted security strategy that includes multi-factor authentication (MFA), advanced malware defenses, and comprehensive endpoint protection supported by Extended Detection and Response (XDR) technology. Additionally, we leverage the expertise of a third-party provider of Managed XDR services, which provides continuous monitoring  across our environment to respond swiftly to potential security events.To reinforce our commitment to cybersecurity, we engage in regular third-party assessments and testing to validate and strengthen our defenses. Independent experts review our incident response and disaster recovery plans, evaluating our capacity to respond to cyber incidents and restore business continuity under adverse conditions. We further enhance our security posture by commissioning robust internal and external penetration tests conducted by third-party providers. These assessments rigorously evaluate our systems for potential vulnerabilities, enabling us to mitigate threats proactively and strengthen resilience against both known and emerging threats. Our organization employs a comprehensive process to oversee and identify cyber threats associated with third-party service providers. For critical systems that handle confidential data, we conduct annual third-party security reviews to evaluate and mitigate potential risks. These reviews include a multifaceted approach combining security questionnaires, in-depth manual assessments of vendor security practices, and automated rating systems to assess vendors' cybersecurity postures. We also maintain an incident response plan that coordinates internal teams and third-party providers to triage, investigate, escalate, contain, remediate and recover from incidents, and to meet applicable legal and contractual obligations. The forensic investigation of the 2025 Cybersecurity Incident is complete and determined that between approximately August 5-8, 2025, a threat actor gained unauthorized access to the Company’s systems and may have acquired certain data. While we have identified the likely scope of the incident, the full operational and financial impacts are still being evaluated. Accordingly, we have not yet determined whether the 2025 Cybersecurity Incident is reasonably likely to have a material impact on the Company. Further, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors – Risks Related to Technology and