Company: HCTI
Filing Date: 2025-02-18
Form Type: 10-K/A
Source: 0001213900-25-014503
Chunk: 53

Company: Healthcare Triangle, Inc.
Filing Date: 2025-02-18
Form: 10-K/A
Chunk 53
---
 of the Company. The Audit Committee performs an annual review of the Company’s cybersecurity program and receives quarterly updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends. HCTI’s technical officers have primary responsibility for the development and oversight of HCTI’s cybersecurity team and the development and maintenance of the company’s related cybersecurity policies and procedures. The team has several years’ worth of experience working in the information and operational technology field and are registered professional engineers. The company’s cybersecurity team continuously assesses the evolving cyber threat landscape based on their expertise and that of our third-party partners. They then work with all parts of HCTI to protect against, detect, identify, respond to, and recover from the risks that cybersecurity threats present. The cybersecurity team views and responds to cybersecurity risks in a holistic manner, applying a comprehensive multilayered strategy to prevent, detect, and mitigate them. They have identified HCTI’s critical cyber assets and taken appropriate steps to protect them. External expertise is regularly engaged to assess HCTI’s cybersecurity program and help the cybersecurity team to strengthen the organization’s monitoring, alerting, prevention, mitigation, and recovery capabilities. Tabletop simulations, third party cyber vulnerability assessments, maturity assessments, and partnerships are used to assess and refine all elements of our cybersecurity program. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of HCTI’s applications are required to document user access reviews regularly. We request a System and Organizational Controls (SOC) 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework. To continually manage and control the material risks that cybersecurity threats present to the organization, HCTI invests significantly in the cybersecurity elements outlined above. In addition, the Company has made significant investments to fulfill the operational and financial regulatory requirements laid out by the North American Electric Reliability Corporation Critical Infrastructure Protection Standards and Sarbanes-Oxley Act of 2002. HCTI faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results