Company: INVUP
Filing Date: 2025-03-28
Form Type: 10-K
Source: 0001641172-25-001193
Chunk: 1113

Company: Investview, Inc.
Filing Date: 2025-03-28
Form: 10-K
Item: Item 1
Chunk 1113
---
 purposes of misappropriating assets or information or causing operational disruption
and damage. To mitigate the risk of an impact to our business operations and/or damage from cybersecurity incidents or cyberattacks,
Investview invests in multiple forms of cybersecurity and operational safeguards.

On
an ongoing basis, we assess our people, processes, and technology, and when necessary, modify the overall program in order to meet the
demands of the ever-changing cyber risk environment. As part of our regular training and readiness program, we conduct phishing and penetration
testing campaigns in order to ensure that our employees are familiar with all types of phishing emails and similar threats.

Our
data is dynamically backed up to mitigate against data loss. To prevent unauthorized access and data breaches, we encrypt sensitive data
both in transit and at rest. We have also implemented access controls and multi-factor authentication to ensure that only authorized
personnel can access sensitive information. We also utilize third-party information technology systems vendors to conduct regular network
and endpoint monitoring.

Our
risk management program is comprised of, among other things, policies that are designed to identify, assess, manage, and mitigate cybersecurity
risk, and is based on applicable laws and regulations, derived from industry standards and best practices. These policies are intended
to identify cybersecurity threats that may be associated with both internally managed systems and systems managed by third-party service
providers.

We
conduct risk assessments to evaluate the effectiveness of our systems and processes in addressing threats and to identify opportunities
for enhancements. Additionally, we conduct privacy and cybersecurity reviews, as well as annual employee training, and monitor emerging
laws and regulations related to information security and data protection. We utilize third party tools and techniques to test and enhance
our security controls, perform annual cybersecurity framework assessments, conduct ongoing penetration testing of our systems, and benchmark
against best practices. Our internal audit function provides an independent assessment on the overall operations of our cybersecurity
program and the supporting framework.

Our
cybersecurity team engages and utilizes third-party services as it monitors and actively responds to cybersecurity threats. We utilize
an Endpoint Detection and Response (EDR) platform, an anti-virus application, through which incoming electronic communications are filtered,
and an email security platform which seeks out identifiers in communications that disguise, impersonate, or otherwise misrepresent the
source of the communication. If such a communication is detected, it is subject to quarantine or removal depending on the severity of
issue. Additionally, we use a Security Information and Event Management (SIEM) system, which allows us to store