Company: HROW
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001641172-25-000925
Chunk: 389

Company: HARROW, INC.
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1B
Chunk 389
---
Not applicable.

ITEM 1C. CYBERSECURITY

We
are subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition and
cash flows, as well as our operations—including our manufacturing and marketing capabilities. We operate a risk-based cybersecurity
program which is designed to: (i) ensure the security, confidentiality, integrity and availability of our information and systems; (ii)
protect against anticipated or actual cyber threats to our information and systems; and (iii) protect against unauthorized access and/or
use of our information and systems. Overall cybersecurity risk reporting is integrated with our enterprise risk management program, is
included in discussions with the Audit Committee of our Board of Directors and disclosed where appropriate. Our information technology
and cybersecurity function is headed by our Chief Executive Officer (“CEO”), and Vice President of Information Technology,
who are responsible for managerial oversight of our cybersecurity program. Our Vice President of Information Technology reports directly
to our CEO.

We
utilize a layered approach in assessing, identifying, evaluating and managing material risks from cybersecurity threats, and leverage
outside partners to gain intelligence on threats. We take input from industry activities, third party assessments and internal simulations
and continuously adjust our protection mechanisms to be effective. We also assess operational and data security risks associated with
our use of third-party service providers, understanding where failure points may exist within our supply chain operations and data protections.
If we learn of a cybersecurity incident at a third-party service provider, our information technology department will maintain communication
with that third-party service provider and communicate any cybersecurity incidents to the Vice President of Information Technology and
CEO. All Harrow employees receive information security training (including data protection and fraud awareness) on an annual basis, and
we use industry standard technology to monitor systems for anomalous behavior. We also require employees in certain roles to complete
additional role-based, specialized cybersecurity trainings. In the event an incident were to occur, a Security Incident Response Team
would be convened that consists of members from many functions, including legal counsel, the Vice President of Information Technology
and the CEO.

Our
Board of Directors has the ultimate oversight of the Company’s risks—including cybersecurity risks—with our Audit Committee
assisting the Board of Directors in its oversight of cyber and information security risks. Members of management that possess information
security certifications and many years of experience work with our legal, finance and corporate governance functions to identify, define
and report cybersecurity risks, policies and procedures and incident response plans. The Audit Committee receives updates