Company: ARRY
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001820721-25-000023
Chunk: 66

Company: Array Technologies, Inc.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 66
---
Item 1C. Cybersecurity

Risk Management and Strategy

Our commercial success depends on developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. Accordingly, we have adopted processes designed to identify, assess and mange material risks from cybersecurity threats.Managing Material Risks & Integrated Enterprise Risk ManagementWe are working to strategically integrate cybersecurity risk management into our broader enterprise risk management program to promote a company-wide culture of cybersecurity risk management. Our enterprise risk management project team is working closely with our IT department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs while building out a framework to monitor those risks and integrate objectives into our broader strategic plan.Engaging Third Parties on Risk ManagementGiven the complexity and evolving nature of cybersecurity threats, we have engaged a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating, testing, and improving our risk management systems. These partnerships enable us to leverage specialized knowledge and insights and includes regular audits, threat assessments, and consultation on security enhancements.Overseeing Third Party RiskThe need to govern third party service providers and vendors poses significant challenges, and as a result we have implemented processes to oversee and manage these risks. Our procedures contemplate conducting security assessments of all third-party providers that are proportional to the risks present, ideally before or soon after engagement, and periodically thereafter, in order to mitigate risks related to data breaches or other security incidents originating from third parties.Risks from Cybersecurity ThreatsWe have not encountered cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, although we cannot rule out that a cyber-attack in the future could materially affect our ability to operate.

Governance

Our board of directors is aware of the critical nature of managing risks associated with cybersecurity threats. In recognition of the significance of these threats to our operational integrity and shareholder confidence, our 

36

board of directors has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.Board of Directors OversightThe Nominating and Corporate Governance Committee of our board of directors bears primary responsibility for oversight of cybersecurity risks. The Nominating and Corporate Governance Committee is briefed on cybersecurity risks at least once each year and any material cybersecurity incidents by our chief information officer and our chief financial officer, as further described below. The Nominating and Corporate Governance Committee is composed of directors equipped with diverse skills needed to oversee the difference facets of cybersecurity risks effectively, including risk management, public company