Lifevantage Corp

Risk Management and Strategy

We have implemented and maintain a cybersecurity risk management program that is designed to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management processes areintegrated into our broader enterprise risk management approach and are overseen through our security steering committee. The security steering committee includes representatives from functional areas such as: cybersecurity and infrastructure; corporate risk and privacy; personnel; and finance and fraud management. The security steering committee is responsible for reviewing cybersecurity risks, monitoring relevant risk trends, supporting prioritization of mitigation activities, and helping coordinate cross-functional responses when appropriate. The committee also supports the evaluation of risk associated with certain third-party service providers, including vendors and technology partners that may have access to Company systems, data, or infrastructure.

We engage third parties, as appropriate, to assist in assessing, identifying, verifying, validating, and addressing cybersecurity risks. These third parties may include cybersecurity assessors, consultants, managed security service providers, auditors, and other external cybersecurity experts. We also use various security tools and processes designed to help identify, escalate, investigate, respond to, and recover from cybersecurity incidents in a timely manner. In addition, we provide periodic cybersecurity training to employees to help promote awareness of cybersecurity risks and reinforce employee responsibility in protecting our systems and information. Our cybersecurity program is intended to reduce risk, support operational resilience, and help protect the confidentiality, integrity, and availability of our systems and data.

We have not identified risks from known cybersecurity threats to the business, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See our risk factor “We are subject to evolving laws, policies, and contractual obligations related to data privacy and security, including cybersecurity, and our actual or perceived failure to comply with such obligations or perceived failure to maintain the integrity of our data could expose us to data loss or litigation, harm our reputation, subject us to significant fines and liability, or otherwise affect our business, prospects, financial condition, and operating results” and “Our development, deployment, use or integration of artificial intelligence technologies may present operational, competitive, legal, regulatory, cybersecurity, privacy, reputational and other risks, and may not achieve the benefits we expect.” in Part I, Item 1A. (“Risk Factors”) for additional details regarding cybersecurity risks and potential impacts on our business.

Cybersecurity Governance

Our board oversees the Company's risk management program, including risks related to cybersecurity. The board carries out its risk oversight responsibilities directly as a full board and, where appropriate, through its committees. The board has delegated to the audit committee primary oversight responsibility for risks and incidents relating to cybersecurity threats, including oversight of related disclosure considerations, cooperation with law enforcement where appropriate, and potential impacts on financial and operational risk. The audit committee receives updates from our Chief Technology Officer (“CTO”) regarding cybersecurity risk, program developments, incident response readiness, notable incidents, findings and recommendations, as appropriate. The audit committee reports material or notable cybersecurity matters to the full board for consideration, as appropriate. Management is responsible for assessing and managing material risk from cybersecurity threats.

Our CTO has primary responsibility for overseeing the Company’s cybersecurity risk management program, including the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents. The CTO is supported by internal information systems and cybersecurity personnel, members of the security steering committee, and third-party cybersecurity resources, as appropriate. Our CTO and other members of management are informed about cybersecurity risks through various means, which may include internal security reviews, reports from security tools deployed in the technical environment, updates from cybersecurity personnel, third-party assessments, vendor risk reviews, and incident response processes.