Company: SRFM
Filing Date: 2025-03-21
Form Type: 10-K
Source: 0000950170-25-043326
Chunk: 112

Company: SURF AIR MOBILITY INC.
Filing Date: 2025-03-21
Form: 10-K
Item: Item 1B
Chunk 112
---
 penalties and settlements, of which there were none. Additional information on cybersecurity risks we face can be found in Part I, Item 1A “Risk Factors” of this Report under the headings “We will rely on our information technology systems to manage numerous aspects of our business. A cyber-attack of these systems could disrupt our ability to deliver services to our customers and could lead to increased overhead costs, decreased sales and harm to our reputation” and “System failures, defects, errors or vulnerabilities in our website, applications, backend systems or other technology systems or those of third-party technology providers could harm our reputation and brand and adversely affect our business, financial condition and results of operations,” which should be read in conjunction with the foregoing information. Cybersecurity is an integral part of our risk management processes and an area of increasing focus for our Board and management. Our Board oversees the Company’s enterprise risk management process, including the management of risks arising from cybersecurity threats.Our Technology Steering Committee comprising executive leadership, business leaders, and IT is responsible for the oversight of risks from cybersecurity threats. The Technology Steering Committee meets regularly to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. We have instituted a quarterly update to our Board members with an overview of the management of our cybersecurity threat risk and strategy processes covering topics such as security posture, progress towards risk-mitigation-related goals, 

52

and emerging threat risks or incidents and developments, as well as the steps management has taken to respond to such risks, if any. Pursuant to our cybersecurity incident response framework, we have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Board, as well as ongoing updates regarding any such incident until it has been addressed. Members of the Board and the Technology Steering Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Our cybersecurity risk management and strategy processes are managed in collaboration between Technology and IT teams in close association with business team leads and the executive team. The global IT team is led by our VP of IT at the Company in collaboration with the VP of Technology at Southern. Such individuals collectively have 25 years of prior work experience in various roles involving managing information security, developing cybersecurity strategies, and implementing effective information and cybersecurity programs.  We also work very closely with a Senior Advisor to the Board who has a CISSP certification for collaborating on strategies regarding cybersecurity risk management