Company: DMRC
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001437749-25-005471
Chunk: 70

Company: Digimarc CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 70
---
 and operational measures, including, but not limited to, cross-functional collaboration among the information security, legal and risk management and operational teams, and Company-wide training on cybersecurity and privacy. We conduct regular and ongoing information security training and maintain a compliance program, which includes live and virtual training and periodic testing to ensure compliance with corporate standards and procedures. New employees must acknowledge that they have completed all the information security training and adhere to standards and procedures upon hire. All other employees acknowledge completion of this training annually. 
    
   In 2024, the Company again achieved System and Organization SOC Type II (“SOC 2”) compliance for its product digitization platform. An independent auditor provided this certification after conducting a comprehensive audit, confirming that from  February 16, 2023, to  February 29, 2024, our information security controls were well-designed and worked effectively. The Company is working diligently to continue to maintain compliance with SOC 2 with the audit for 2025 currently in process. 
    
   Our Board of Directors plays a vital role in overseeing the Company’s enterprise risk management program and has delegated cybersecurity risk management to the Audit Committee of the Board of Directors. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed, and to implement processes to manage cybersecurity risks and mitigate cybersecurity incidents. Our Senior Director of InfoSec provides annual updates to the Audit Committee on the current cybersecurity threat landscape, emerging risks, remediation plans, and the effectiveness of related internal controls, and our Chief Financial Officer provides quarterly updates to the Audit Committee regarding progress on the Company’s cybersecurity program. When applicable, additional cybersecurity updates are provided to our Audit Committee in interim periods in the event of a significant cybersecurity threat. All members of the Board of Directors are invited to attend these meetings.
    
   The Audit Committee regularly engages in risk assessments specifically focused on cybersecurity, considering potential impacts on operations, financial results, and reputation, and periodically reviews cybersecurity policies and procedures to ensure they align with best practices and evolving cyber threats. In addition, the Audit Committee participates in the allocation of resources for cybersecurity initiatives, ensuring that investments align with the Company’s risk appetite and strategic objectives. The Audit Committee is also briefed on the Company’s crisis management and incident response plans, ensuring preparedness for potential cybersecurity incidents. The full Board of Directors participates with management in security tabletop exercises to test our incident response plans.
    
   In 2024, we did not identify any cybersecurity threats