Company: HCTI
Filing Date: 2025-02-18
Form Type: 10-K/A
Source: 0001213900-25-014503
Chunk: 52

Company: Healthcare Triangle, Inc.
Filing Date: 2025-02-18
Form: 10-K/A
Chunk 52
---
 addressing cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a dedicated cybersecurity team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify potential cyber threats. External third party security firms are engaged to assist with cybersecurity risk assessments, penetration testing and system security analysis. HCTI’s cybersecurity team works in conjunction with the risk management, legal, finance, accounting, operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. To ensure consistency, these cybersecurity risk assessments are incorporated into HCTI’s Enterprise Risk Management process, HCTI’s information technology leadership reviews the company’s enterprise risk management-level cybersecurity risks on a quarterly basis, and key cybersecurity risks are incorporated into HCTI’s enterprise risk management framework. Cybersecurity risks are managed and controlled through multiple overlapping layers of cybersecurity defenses that include :

| ● | expert                                           
 input from both public and private partnerships; |

| ● | the                                                                                           
 implementation of a comprehensive cybersecurity policy that encompasses but is not limited    
 to social media, acceptable use (devices, wireless, remote access, internet use), information 
 governance, monitoring, authentication, encryption, vulnerability management, third-party     
 management, and recovery;                                                                     |

| ● | required                                                                                   
 annual cybersecurity training for all employees with additional supplemental cybersecurity 
 training required based on role;                                                           |

| ● | random                                
 employee phish testing and follow-up; |

| ● | procedural                                                                                  
 and automated cyber controls in conjunction with robust detection, mitigation, and recovery 
 capabilities;                                                                               |

| ● | the                                                                    
 formation of a multidisciplinary cybersecurity incident response team; |

| ● | the                                                                                             
 integration of multiple threat intelligence sources into our cybersecurity tools and processes; |

| ● | the                                                            
 retention of external cybersecurity threat response resources; |

| ● | the                                                                        
 formation of a multidisciplinary cybersecurity incident response team; and |

| ● | multiple                                                                                  
 cyber event simulation and tabletop exercises per year to hone the cybersecurity incident 
 response team preparedness.                                                               |

32 The HCTI board of directors provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, whichassists the Board in fulfilling its oversight responsibilities regarding the Company’s policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing the Company’s information security policies and internal controls regarding information security; and reviewing the Company’s annual disclosures concerning the role of the Board in the risk oversight