Company: OFIX
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000950170-25-026066
Chunk: 162

Company: Orthofix Medical Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1B
Chunk 162
---
None. 

Item 1C.	CybersecurityRisk Management and StrategyWe have implemented cybersecurity programs designed to maintain and protect our information technology systems and the confidentiality, integrity, and availability of our data. These programs serve to maintain compliance with applicable laws and regulations governing ethical business practices, including our relationships with suppliers, customers, and business partners. We maintain formal processes for our cybersecurity program and incident response procedures, which are updated at least annually and reviewed by external legal and cybersecurity advisors. These processes include, among other things, detailed steps on how we assess cyber risks, identify threats, and determine the materiality of cyber incidents. These processes also designate certain roles within the company to execute these policies and certain leadership roles to manage material risk escalation. These processes endeavor to follow the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and are tested at least annually. Our Information Security team uses automated technology, third-party partners, and direct review of system indicators to monitor and implement the prevention, detection, mitigation, and remediation of cybersecurity incidents, and to stay current with the changing threat landscape. We also leverage encryption technologies and other measures to safeguard systems. We engage third parties as part of our cyber program, including external security firms that provide security technology, conduct regular security audits, and conduct penetration testing. We also engage third parties to conduct regular drills, such as tabletop exercises, to help with our overall preparedness. We also engage third-party service providers to assist with managing various other aspects of our business. We have implemented processes designed to both assess and maintain oversight of third-party service providers with regards to cybersecurity risks. These service providers are subject to due diligence reviews of their information security programs during our vendor evaluation process. Our employees are responsible for complying with our data security standards and are required to complete annual training to understand the behaviors and technical requirements necessary to keep data secure. We also require that cybersecurity training be part of the onboarding process for new hires.As of December 31, 2024, cybersecurity risks have not materially affected our business strategy, results of operations, or financial condition.

52

GovernanceCybersecurity is an important component of our enterprise risk management program. While the full Board of Directors has primary responsibility for risk oversight, the Board of Directors utilizes its committees, as appropriate, to monitor and address the risks that may be within the scope of a particular committee’s expertise or charter. The Board of Directors receives updates at quarterly board meetings on committee activities from each committee Chair.The Audit and Finance Committee has oversight over and regularly