Company: CPSS
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001683168-25-001548
Chunk: 435

Company: CONSUMER PORTFOLIO SERVICES, INC.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1C
Chunk 435
---
Risk Management and Strategy 

Our information security policies
and processes are designed to assess, identify, and manage material risks from cybersecurity threats, including protecting the security
and confidentiality of consumer information. We use various tools and strategies to identify and assess material risks from cybersecurity
threats. We conduct ongoing cybersecurity gap analysis and risks assessments, vulnerability testing, and penetration testing. The cybersecurity
risk assessments, vulnerability testing, and penetration testing are designed to identify internal and external risks to the security
of our information systems.

We also actively monitor our
systems and connections for abnormal activity, including malicious phishing attempts. This includes the use of intrusion detection systems,
log analysis, and real-time monitoring of critical systems. We have an incident reporting portal available to all employees to submit
any issues they suspect may pose a risk to our information technology (“IT”) systems and security.

 29 

We use the results of the
above-described tools and strategies to assess the sufficiency of the safeguards in place to manage material risks from cybersecurity
threats, to enhance such safeguards, or implement new safeguards, as necessary. We have several safeguards in place to manage material
risks from cybersecurity threats. We have security awareness training for our employees, including ongoing simulated phishing email campaigns.
We utilize firewalls, anti-virus software, encryption on stored data and communication channels, secure web portals for remote access
to our systems, password security, and two-factor authentication. We continuously update our software and security patches. We restrict
inbound email attachments, certain websites, and cloud-based drives. We monitor and restrict information transfers to and from unauthorized
IP addresses. We also have physical security safeguards for our locations and data centers. We back up our systems and data regularly.
In addition, we have a disaster recovery program designed to help us respond to and recover from an interruption of critical IT services.

As part of our overall risk
management processes, we engage in a multi-departmental strategy to assess and incorporate the above processes and involve other departments
as needed, including IT, Systems, Risk Management, and Legal. We engage assessors, consultants, auditors, or other third parties to assist
with some of the processes above, including conducting risk and gap assessments, IT audits and consulting, system monitoring, vulnerability
testing, and penetration testing. To oversee and identify material cybersecurity risks associated with our use of third-party service
providers, we limit data access for third-party service providers to only the data that is necessary for the given function and conduct
due diligence on