Company: HROW
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001641172-25-000925
Chunk: 88

Company: HARROW, INC.
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1
Chunk 88
---
, evaluating and managing material risks from cybersecurity threats, and leverage
outside partners to gain intelligence on threats. We take input from industry activities, third party assessments and internal simulations
and continuously adjust our protection mechanisms to be effective. We also assess operational and data security risks associated with
our use of third-party service providers, understanding where failure points may exist within our supply chain operations and data protections.
If we learn of a cybersecurity incident at a third-party service provider, our information technology department will maintain communication
with that third-party service provider and communicate any cybersecurity incidents to the Vice President of Information Technology and
CEO. All Harrow employees receive information security training (including data protection and fraud awareness) on an annual basis, and
we use industry standard technology to monitor systems for anomalous behavior. We also require employees in certain roles to complete
additional role-based, specialized cybersecurity trainings. In the event an incident were to occur, a Security Incident Response Team
would be convened that consists of members from many functions, including legal counsel, the Vice President of Information Technology
and the CEO.

Our
Board of Directors has the ultimate oversight of the Company’s risks—including cybersecurity risks—with our Audit Committee
assisting the Board of Directors in its oversight of cyber and information security risks. Members of management that possess information
security certifications and many years of experience work with our legal, finance and corporate governance functions to identify, define
and report cybersecurity risks, policies and procedures and incident response plans. The Audit Committee receives updates on our cybersecurity
program from management on a regular basis and more frequently as determined to be necessary or advisable. Updates to the Audit Committee
include policies, processes, procedures and any significant developments related to the identification, mitigation and remediation of
cybersecurity risks, as well as effectiveness and changes in our ability to monitor, protect, detect and respond to incidents, risk reviews
and industry news briefings. The Audit Committee also ensures that management provides a cyber and information security update to the
Board of Directors at least annually. Finally, in the event a material cybersecurity incident were to occur, the CEO and Vice President
of Information Technology would brief the Audit Committee which would then be responsible for assessing the materiality of the incident
and making the determination of materiality and any related disclosure.

We
face a number of cybersecurity risks in connection with our business. Although we have numerous controls to protect against common attacks,
some attacks may still be effective. Our controls are designed to detect, triage and eradicate these attacks. While we