Company: PHR
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001412408-25-000010
Chunk: 157

Company: Phreesia, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1C
Chunk 157
---
Item 1C. Cybersecurity

49

As a healthcare-focused company, we understand the importance of managing cybersecurity risks that we face and have established a cybersecurity risk management program as part of our enterprise risk management program. 

Cyber Risk Management and Strategy

Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework and The Health Information Trust Alliance (HITRUST) Common Security Framework. Additionally, we are certified as a PCI-DSS Level 1 Service Provider. The Company’s cybersecurity program utilizes a cross functional, multilayered defense-in-depth approach designed to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store; (iii) protect the Company’s intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure and required notices of cybersecurity risks and incidents when required.Our cybersecurity program includes safeguards that are designed to protect the Company’s information systems from cybersecurity threats. Such safeguards include firewalls, automated intrusion detection systems, anti-malware functionality and access controls, which are evaluated and improved through periodic vulnerability assessments and ongoing cybersecurity threat intelligence. We have established and maintain an incident response plan that addresses the Company’s response to and recovery from a cybersecurity incident. The incident response plan is tested and evaluated on an annual basis. The Company’s cybersecurity program is supported by engagement of third-party service providers who help identify, assess and respond to cybersecurity risks. For example, the Company regularly engages third parties to perform and facilitate assessments on our cybersecurity measures, including information security maturity assessments, audits, tabletop exercises, threat modeling and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to leadership, the Audit Committee, and/or the Board, as appropriate, and the Company adjusts its cybersecurity policies, standards, processes and practices as appropriate based on the information provided by the assessments, audits and reviews.As part of our cybersecurity risk management program, we maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company’s systems, as well as the systems of third parties that could adversely impact our business. Further, all personnel are required to undergo cybersecurity training during onboarding and, thereafter, on an annual basis to reinforce the Company’s information security policies