Company: INGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029993
Chunk: 38

Company: Inogen Inc
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1B
Chunk 38
---
None. 

ITEM 1C. CYBERSECURITYIntroduction: The medical device industry faces unique cybersecurity challenges, given the sensitive nature of the data and the critical role of devices in patient care. Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, patients and customers. We are committed to implementing robust security measures to protect against potential cyber threats and vulnerabilities that are constantly evolving across the globe.Risk Management and Strategy: We have processes for assessing, identifying, and managing cybersecurity threats, and cybersecurity is an integral part of our overall enterprise risk management program which is overseen by our Audit Committee and the Board. Our strategy includes a comprehensive cybersecurity framework, utilizing advanced technologies and methodologies, such as cloud migrations and deployment of threat detection tools to effectively mitigate potential risks. Continuous risk assessments help us better refine our strategy, guiding the deployment of technical safeguards and shaping our incident response plans. For acquired companies, our integration strategies prioritize establishing comprehensive timelines for harmonizing information security, data privacy, and cybersecurity practices. This includes a strong focus on aligning employee education programs to ensure a seamless transition and uphold security and privacy standards across our entities.Our cybersecurity infrastructure is based on a multi-layered defense framework, aligned with the U.S. National Institute of Standards and Technology guidelines. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Biannual penetration testing and regular assessments by external experts validate the effectiveness of our cybersecurity measures. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.We have insurance coverage in place for certain potential liabilities and costs relating to cybersecurity risks, data security incidents and/or network