Company: IIIV
Filing Date: 2025-11-21
Form Type: 10-K
Source: 0001728688-25-000122
Chunk: 84

Company: i3 Verticals, Inc.
Filing Date: 2025-11-21
Form: 10-K
Item: Item 1C
Chunk 84
---
Item 1C.    Cybersecurity

Cybersecurity ProgramWe maintain a cybersecurity program that implements required controls for all Company businesses, with day-to-day management and implementation often conducted independently due to our decentralized operating model. While cybersecurity technologies and implementation may differ based on the needs and risk profile of each individual business, we implement standards at the enterprise level and provide centralized oversight work to ensure alignment and consistency. Our cybersecurity team deploys an array of capabilities to ensure the availability, integrity, and confidentiality of key business systems, supported by centrally monitored cyber tools and managed services. Our cybersecurity programs operate in service of the following express principles:•Identify: Intended to ensure that our IT team has a comprehensive understanding of our systems and data environment to effectively manage security risks to key assets, data, and services.•Protect: Implementing controls and safeguards that allow employees to work securely and with confidence, which are intended to enable the continued delivery of essential business services. Our program follows guidelines from the National Institute of Standards and Technology (NIST), Center for Internet Security (CIS), Cloud Service Alliance (CSA), Payment Card Industry (PCI), HIPAA and applicable privacy regulations, and select programs are subject to continuous oversight through ongoing SOC 2 compliance audits.•Detect: Utilizing both external and internal resources to perform continuous assessments and penetration testing throughout the year on the Company’s key business systems, including an annual review to verify our compliance with the Payment Card Industries Data Security Standards (PCI DSS). We deploy systems, capabilities, and processes designed to detect cybersecurity events as early as possible to ensure the resilience of our systems and our ability to identify threats.•Respond & Recover: Equipping the Company with the necessary capabilities to take immediate and effective action against detected threats. Our incident response plan has a structured escalation process for managing and reporting cybersecurity incidents, starting with initial detection and local management review, escalating to enterprise-level teams, and potentially reaching the Audit Committee of the Company's Board of Directors, if the incident is deemed material. •Awareness: Promoting ongoing user awareness and training so that all employees understand their role in managing cybersecurity risks. Mandatory new hire and annual security and privacy training is provided to all employees, including automated monthly phishing campaigns to educate staff on identifying and reporting phishing threats.

45

•Third Parties: Processes designed to identify and manage cybersecurity risks associated with our use of third-party providers. These include cybersecurity due diligence efforts, targeted risk oversight, monitoring and mitigation efforts and contractual protections, as necessary.  We utilize both external and internal resources to