Risk Factors Dashboard
Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.
View risk factors by ticker
Search filings by term
Risk Factors - AAME
-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing
Item 1A.
Risk Factors
As a smaller reporting company as defined by Rule 12b-2 of the Exchange Act and in Item 10(f)(1) of Regulation S-K (a “smaller reporting company”), we have elected to comply with certain scaled disclosure reporting obligations, and therefore are not providing the information required by this Item.
| Item 1B. | Unresolved Staff Comments |
Not applicable.
| Item 1C. | Cybersecurity |
Risk Management and Strategy
The Company’s operations rely on the secure processing, storage, and transmission of confidential and personal identifiable information within various technology platforms. Cybersecurity is a high priority and the Company has made significant investments in its processes and programs designed to prevent, detect, and respond to and recover from cybersecurity threats. Cybersecurity is a high priority and the Company has made significant investments in its processes and programs designed to prevent, detect, and respond to and recover from cybersecurity threats. We also have processes in place to help ensure compliance with our information security program with respect to our use of third-party service providers, including review of vendor certifications, execution of appropriate data protection agreements, and contractual security requirements. The Company is actively maturing its third-party risk management program to establish risk-based vendor tiering, due diligence standards, and ongoing monitoring controls for vendors. The Company’s cybersecurity program is structured around the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”), which guides our approach to identifying, protecting, detecting, responding to, and recovering from cybersecurity risks. The Company maintains an active cybersecurity roadmap aligned to NIST CSF to continuously mature its security posture and address identified risks. Such processes and programs are a part of the Company’s overall risk management and compliance programs. The Company continues to enhance its intrusion protection and detection technology, infrastructure and application firewalls, and network monitoring. The Company continues to enhance its intrusion protection and detection technology, infrastructure and application firewalls, and network monitoring. The Company has also installed advanced endpoint threat protection technology and implemented a mandatory security awareness training program for all employees. The Company enforces multi-factor authentication and least-privilege access principles across critical systems. The Company has identified its current network architecture as an area of elevated risk and is actively executing a cybersecurity roadmap, aligned to the NIST CSF, to transition to a segmented, enterprise-grade network infrastructure. This initiative includes the replacement of end-of-life network equipment and the implementation of network segmentation controls to reduce lateral movement risk. This training is reinforced through periodic simulated phishing tests to assess our employees’ responses to suspicious emails. This training is reinforced through periodic simulated phishing tests to assess our employees’ responses to suspicious emails.
The Company maintains backup and recovery capabilities designed to help enable us to resume business in the event of a disaster or cybersecurity incident. The Company has identified resilience and recovery as a key area of focus within its cybersecurity roadmap and is actively working toward implementing cloud-enabled Business Continuity and Disaster Recovery (“BCDR”) with validated, tested recovery objectives designed to meet applicable BCDR compliance requirements. Through recurring internal audits, controls are regularly reviewed, tested, and enhanced to promote best practices. Through recurring internal and external audits, controls are regularly reviewed, tested, and enhanced to promote best practices. The Company recognizes ransomware and software supply chain compromises as significant threat vectors and is implementing controls including vendor integrity validation, and rapid isolation protocols as part of its evolving incident response capabilities. The Company has augmented our information security program through a partnership with a leading global cybersecurity service provider to review and implement additional services such as Security Event Monitoring, Advanced Endpoint Threat Detection, Incident Management Retainer Services, and Strategic Advisory Services focused on Chief Information Officer (“CIO”) duties such as counter-threat intelligence.
Our information security program also includes a cybersecurity Incident Response Plan (“IRP”) that is designed to help protect the integrity, availability and confidentiality of information, prevent loss of service, and comply with legal requirements. The IRP specifies the process for identifying and reporting an incident, initial investigation, risk classification, documentation and communication of incidents, responder procedures, incident reporting, and ongoing training. The IRP also includes processes for determining the materiality of the incident, including the assessment of relevant qualitative and quantitative factors. Upon identifying a potential cybersecurity incident, the Company follows a structured assessment process to determine materiality and, where applicable, fulfill its obligation to disclose such incident in accordance with SEC rules. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our board of directors, third-party advisors and other stakeholders. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our board of directors, third-party advisors and other stakeholders.
The Company also maintains dedicated cyber liability insurance for breach event costs including: post breach event remediation costs; cybercrime coverage (including financial fraud, telecommunications fraud, and phishing attacks); and coverage for system failure, bricking loss, and physical damage. The policy also provides coverage for lost revenue due to a damaged reputation from a cyber breach.
While no cybersecurity incidents have materially affected or are reasonably likely to materially affect our operations to date, there can be no assurance that future incidents will not have a material impact on the Company’s business, financial condition, or results of operations.
Governance
Our board of directors recognizes the important role of information security and mitigating cybersecurity and other data security threats. Although our full board of directors maintains ultimate responsibility with respect to risk management oversight, our board of directors has delegated oversight of the Company’s information security program and matters of cybersecurity to the Audit Committee of the board of directors. The Audit Committee receives regular briefings from the CIO on the state of the cybersecurity program, emerging threats, and the Company’s risk mitigation progress against its cybersecurity roadmap. The Company’s senior officers, including its CIO, are responsible for the operation of the information security program and regularly communicate with the Audit Committee
In addition, the Company’s information technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security. Our data security employees have backgrounds in cybersecurity and data protection, including prior relevant experience in the industry and industry standard certifications. Our data security employees have backgrounds in cybersecurity and data protection, including prior relevant experience in the industry and industry standard certifications.
Recently Filed
Click on a ticker to see risk factors
| Ticker * | File Date |
|---|---|
| AAME | 36 minutes ago |
| CMC | 6 hours ago |
| LEEN | 8 hours ago |
| ACN | 10 hours ago |
| AWCA | 22 hours ago |
| CLRCF | 23 hours ago |
| ZICX | 1 day, 4 hours ago |
| CMTL | 2 days ago |
| EVOH | 2 days, 7 hours ago |
| NGTF | 3 days ago |
| SAGU | 3 days ago |
| ADVB | 3 days, 1 hour ago |
| OKMN | 3 days, 1 hour ago |
| ESMC | 3 days, 1 hour ago |
| MWAI | 3 days, 2 hours ago |
| BRWC | 3 days, 8 hours ago |
| OZVN | 3 days, 11 hours ago |
| GHST | 1 week ago |
| MU | 1 week ago |
| ODC | 1 week, 1 day ago |
| VLGEA | 1 week, 1 day ago |
| ALDS | 1 week, 1 day ago |
| MGNC | 1 week, 2 days ago |
| COST | 1 week, 2 days ago |
| CVAT | 1 week, 3 days ago |
| IPW | 2 weeks ago |
| LDDD | 2 weeks, 1 day ago |
| NVA | 2 weeks, 2 days ago |
| IDT | 2 weeks, 3 days ago |
| SGLY | 2 weeks, 3 days ago |
| LUVU | 2 weeks, 3 days ago |
| BNET | 2 weeks, 3 days ago |
| UEC | 2 weeks, 3 days ago |
| WSTN | 2 weeks, 3 days ago |
| CPRT | 2 weeks, 3 days ago |
| VIPZ | 2 weeks, 3 days ago |
| ZONE | 2 weeks, 3 days ago |
| MKZR | 2 weeks, 3 days ago |
| CAST | 2 weeks, 4 days ago |
| TRAK | 2 weeks, 4 days ago |
| SGLA | 2 weeks, 4 days ago |
| BLNH | 2 weeks, 4 days ago |
| XLAB | 2 weeks, 4 days ago |
| INTG | 2 weeks, 4 days ago |
| PRSI | 2 weeks, 4 days ago |
| MITQ | 2 weeks, 4 days ago |
| NTWK | 2 weeks, 4 days ago |
| FKWL | 2 weeks, 4 days ago |
| EONR | 2 weeks, 4 days ago |
| GLNS | 2 weeks, 4 days ago |
