Company: IIIV
Filing Date: 2025-11-21
Form Type: 10-K
Source: 0001728688-25-000122
Chunk: 85

Company: i3 Verticals, Inc.
Filing Date: 2025-11-21
Form: 10-K
Item: Item 1C
Chunk 85
---
 perform assessments and penetration testing throughout the year on the Company’s key business systems, including an annual review to verify our compliance with the Payment Card Industries Data Security Standards (PCI DSS). Additionally, we engage consulting firms and other third parties to conduct evaluations of our security controls, including penetration testing and independent audits, and to advise the Company's Audit Committee, and our management team on cybersecurity matters.While we have experienced cyber threats and incidents, we have not (whether directly or indirectly, including through our third-party vendors, or customers or other business relations) been subject to a cybersecurity event of which we are aware that has had a material impact on us, including our business strategy, financial condition or results of operations. However, despite our security measures, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that materially impacts us. For additional information regarding the risks to us associated with cybersecurity incidents and cybersecurity or technological risks, see “Unauthorized disclosure, destruction or modification of data or disruption of our services or other cybersecurity or technological risks, including as a result of a cybersecurity incident, could expose us to liability, protracted and costly litigation and damage our reputation.” included in Part I, Item 1A of this Form 10-K.

We maintain a cybersecurity insurance policy that provides coverage in connection with cybersecurity incidents. However, such insurance coverage may exclude certain types of claims or otherwise be insufficient to cover all costs and damages associated with cybersecurity incidents, and (to the extent that costs and damages are otherwise covered) are subject to applicable deductibles.

Governance

While the Company’s Board of Directors has the ultimate responsibility for risk management, the Board has designated the Audit Committee as being primarily responsible for certain specific categories of risk oversight matters, including the oversight of the Company's privacy, data and cybersecurity risk exposures, such as the steps management has taken to monitor and mitigate such exposures and protect against threats to the Company’s information systems and security. Our cybersecurity risk management processes are integrated into our overall risk management system.At a management level, the Company’s cybersecurity risk management program is led by our Chief Technology Officer (CTO), who reports to the Company’s President and regularly briefs him on developments that impact the program. Our CTO brings over twenty years of executive leadership experience, providing sponsorship for cybersecurity programs and compliance efforts. He has worked to promote a culture of strong IT governance and organizational resilience, collaborating with subject matter experts to advance cybersecurity initiatives and compliance. His hands-on experience integrating security-focused practices as