Company: FTCI
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0000950170-25-047224
Chunk: 166

Company: FTC Solar, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1B
Chunk 166
---
 standing.GovernanceBoard of Directors OversightOur Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and has established oversight mechanisms to ensure effective governance in managing these risks. The Audit Committee is central to the Board's oversight and has been directed to assume primary responsibility for such oversight by the Board. The Audit Committee is comprised of board members with diverse experience including risk management, technology and finance, which, in the judgment of the Board, equips them with the ability to oversee 

37

Table of Contents

cybersecurity risks effectively. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance to our management and approval of major initiatives.Management's Role Managing RiskWe have established a Cybersecurity Governance Committee, which meets monthly or more frequently, if needed, to monitor:•our current cybersecurity controls and our ability to address emerging threats;•the status of our ongoing cybersecurity initiatives and strategy;•incident reports from any cybersecurity events; and•compliance with regulatory requirements and industry standards. During 2024, members of our Cybersecurity Governance Committee included our Chief Financial Officer, Vice President of Software, Senior Manager of IT, Corporate Controller, Director of SEC Reporting and Technical Accounting, and Director of Internal Audit. Our Chief Financial Officer, Corporate Controller, Director of SEC Reporting and Technical Accounting and Director of Internal Audit each have a number of years of experience in auditing internal controls and assessing risk processes of public companies, including controls involving a company's information technology systems. Our Vice President of Software has a number of years of experience leading software development efforts, including ensuring new software has proper safeguards included to minimize the risk of cybersecurity events. Finally, our Senior Manager of IT has a number of years of experience in implementing and monitoring controls and processes in a company's information technology systems environment that are designed to minimize the risk of cybersecurity events. Accordingly, we believe the members of our Cybersecurity Governance Committee have relevant knowledge and experience in either IT systems, auditing of controls over IT systems, or management and assessment of risk processes and internal control systems to ensure proper management oversight. Our IT management is responsible for notifying the Cybersecurity Governance Committee of cyber incidents they become aware of from software alerts, third-party vendors, employees or by other means. The Cybersecurity Governance Committee will review such incidents, including activities by IT management to evaluate the severity of the incidents, and will provide details of any cybersecurity events, including those not deemed to have a material impact, to our Internal Controls and Disclosure Committee for reporting to our Audit Committee. In addition,