Company: GOLD
Filing Date: 2025-09-11
Form Type: 10-K
Source: 0001193125-25-200462
Chunk: 10

Company: Gold.com, Inc.
Filing Date: 2025-09-11
Form: 10-K
Item: Item 1C
Chunk 10
---
 and SGI. These individuals report cybersecurity incidents immediately to our Chief Information Officer ("CIO") and Chief Privacy Officer ("CPO"), who in turn follow approved incident response and reporting protocols, as more fully described below. 

Our Cybersecurity Compliance and Disclosure Committee ("CCDC"), which is further described below, is chaired by our CIO and includes the General Counsel and the CPO of A-Mark and other representatives from the Company and our subsidiaries, including top-level management, to ensure enterprise-wide implementation and consistent application of the Company’s data security, privacy, and artificial intelligence policies and procedures. The CCDC regularly enlists internal and external subject matter experts to assist where necessary. 

We also maintain a formal Vendor Management Program that provides oversight of cybersecurity risks related to our vendor and supplier relationships. During vendor onboarding, we perform risk-based due diligence on these third-parties, with heightened requirements for vendors that have access to confidential enterprise information, personal data, or that require access to our information systems. This Vendor Management Program includes specific cybersecurity requirements for our vendors, as well as ongoing monitoring, assessment, and contract review. Members of the CCDC are involved in and review the Vendor Management Program annually.

We also maintain a formal Generative Artificial Intelligence ("GAI") Policy and Program that provides oversight of cybersecurity, privacy, and contractual risks related to enterprise use of GAI. All GAI tools and use cases must be submitted for review and approval by a subcommittee of CCDC members based on specific cybersecurity, privacy, and contractual requirements.

To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all cybersecurity threats and incidents. For more information on the risks that we face from cybersecurity threats, see “Risk Factors – Risk Factors of General Applicability—Legislatures and regulators continue to scrutinize cybersecurity management and incident reporting.” in Part 1, Item 1A of this report.