XML 23 R11.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management, Strategy, and Governance
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Item 1C. Cybersecurity.

Risk Management and Strategy

The Company’s Information Technology team has established an information security management system to safeguard the confidentiality, integrity, and availability of the Company’s products, infrastructure, and data. This system is integrated with our Quality and Business Management Systems and aims to identify, assess, and address cybersecurity risks affecting our business. It features an Incident Response Procedure (“IRP”) that specifies roles and responsibilities during security incidents, detailing incident detection, investigation, mitigation, and prompt incident reporting procedures.

Additionally, we conduct regular internal assessments and audits, complemented by insights from external experts. The outcomes of these evaluations are communicated to senior leadership. Based on these risk assessments, we redesign, implement, and maintain adequate safeguards to reduce identified risks, address gaps, and continuously assess the efficacy of these measures. Our engagement with our key partners, vendors, customers, industry stakeholders, and government bodies is ongoing, aiming to improve our information security policies and procedures over time. We aim to diligently manage risks related to cybersecurity threats from third-party service providers, including, when possible, requesting our service providers to report incidents that may compromise the Company’s data.

Risks from Threats and Incidents

Our IT infrastructure, encompassing operational and security systems, integrated software, and data processed by us or our third-party vendors, is vulnerable to cybersecurity threats and incidents. As of December 31, 2024, these risks have not significantly impacted the Company, including our business strategy, or operational results, or financial results. While we devote resources to our security measures to protect our systems and information, these

measures cannot provide absolute security. See Part I, Item 1A. “Risk Factors” of this report for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

Governance

Our Chief Technology Officer is tasked with assessing and managing significant cybersecurity risks across the Company based on the assessments of our IT Director. Our IT Director brings substantial IT and Information Security expertise from various roles in the technology industry.

The IT Director leads and coordinates cybersecurity efforts at Aeva, providing regular updates on cybersecurity progress to the senior leadership team. The Information Security team actively shares updates on the status of cybersecurity efforts and risks, evaluates our information security programs, and monitors the evolving threat landscape on a company-wide level.

The Audit Committee oversees our cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats and incidents. When incidents occur, depending on the nature and severity, the Audit Committee is notified, and incidents are further reviewed with the Audit Committee. Material cybersecurity matters will be reviewed with the full Board of Directors.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] This system is integrated with our Quality and Business Management Systems and aims to identify, assess, and address cybersecurity risks affecting our business. It features an Incident Response Procedure (“IRP”) that specifies roles and responsibilities during security incidents, detailing incident detection, investigation, mitigation, and prompt incident reporting procedures.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Our Chief Technology Officer is tasked with assessing and managing significant cybersecurity risks across the Company based on the assessments of our IT Director. Our IT Director brings substantial IT and Information Security expertise from various roles in the technology industry.

The IT Director leads and coordinates cybersecurity efforts at Aeva, providing regular updates on cybersecurity progress to the senior leadership team. The Information Security team actively shares updates on the status of cybersecurity efforts and risks, evaluates our information security programs, and monitors the evolving threat landscape on a company-wide level.

The Audit Committee oversees our cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats and incidents. When incidents occur, depending on the nature and severity, the Audit Committee is notified, and incidents are further reviewed with the Audit Committee. Material cybersecurity matters will be reviewed with the full Board of Directors.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Chief Technology Officer is tasked with assessing and managing significant cybersecurity risks across the Company based on the assessments of our IT Director
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

The IT Director leads and coordinates cybersecurity efforts at Aeva, providing regular updates on cybersecurity progress to the senior leadership team. The Information Security team actively shares updates on the status of cybersecurity efforts and risks, evaluates our information security programs, and monitors the evolving threat landscape on a company-wide level.

Cybersecurity Risk Role of Management [Text Block]

Our Chief Technology Officer is tasked with assessing and managing significant cybersecurity risks across the Company based on the assessments of our IT Director. Our IT Director brings substantial IT and Information Security expertise from various roles in the technology industry.

The IT Director leads and coordinates cybersecurity efforts at Aeva, providing regular updates on cybersecurity progress to the senior leadership team. The Information Security team actively shares updates on the status of cybersecurity efforts and risks, evaluates our information security programs, and monitors the evolving threat landscape on a company-wide level.

Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our IT Director brings substantial IT and Information Security expertise from various roles in the technology industry.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Audit Committee oversees our cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats and incidents. When incidents occur, depending on the nature and severity, the Audit Committee is notified, and incidents are further reviewed with the Audit Committee
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true