Company: HROW
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001641172-25-000925
Chunk: 268

Company: HARROW, INC.
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1A
Chunk 268
---
 protection and fraud awareness) on an annual basis, and
we use industry standard technology to monitor systems for anomalous behavior. We also require employees in certain roles to complete
additional role-based, specialized cybersecurity trainings. In the event an incident were to occur, a Security Incident Response Team
would be convened that consists of members from many functions, including legal counsel, the Vice President of Information Technology
and the CEO.

Our
Board of Directors has the ultimate oversight of the Company’s risks—including cybersecurity risks—with our Audit Committee
assisting the Board of Directors in its oversight of cyber and information security risks. Members of management that possess information
security certifications and many years of experience work with our legal, finance and corporate governance functions to identify, define
and report cybersecurity risks, policies and procedures and incident response plans. The Audit Committee receives updates on our cybersecurity
program from management on a regular basis and more frequently as determined to be necessary or advisable. Updates to the Audit Committee
include policies, processes, procedures and any significant developments related to the identification, mitigation and remediation of
cybersecurity risks, as well as effectiveness and changes in our ability to monitor, protect, detect and respond to incidents, risk reviews
and industry news briefings. The Audit Committee also ensures that management provides a cyber and information security update to the
Board of Directors at least annually. Finally, in the event a material cybersecurity incident were to occur, the CEO and Vice President
of Information Technology would brief the Audit Committee which would then be responsible for assessing the materiality of the incident
and making the determination of materiality and any related disclosure.

We
face a number of cybersecurity risks in connection with our business. Although we have numerous controls to protect against common attacks,
some attacks may still be effective. Our controls are designed to detect, triage and eradicate these attacks. While we carry a cyber
insurance policy to help cover investigation and mitigation expenses, it may be subject to limitations and be insufficient to cover all
expenses that may result from a cybersecurity incident. Although the risks from cybersecurity threats, including as a result of any previous
cybersecurity incidents, have not materially affected or are reasonably likely to materially affect us, including our business strategy,
results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue
to increase in frequency and sophistication.

 52 

In November
2024, we became aware of a cybersecurity incident that involved unauthorized access of an employee’s email account. Through this