Search every filing
2,477,667 paragraphs from 10-Ks, 10-Qs and 8-Ks with press releases.
Matching paragraphs
• Incident Response Plans: We maintain and update incident response plans that address the life cycle of a cybersecurity incident and routinely evaluate the effectiveness of such plans. Incident response plans focus on cybersecurity risk issues, including detection, response and recovery; cybersecurity threats, including external communication and legal compliance; and breach simulations and penetration testing through internal and external exercises. We have previously engaged a third-party expert to oversee a cybersecurity incident response exercise to test pre-planned response actions from our incident response plan and to facilitate group discussions regarding the effectiveness of our cybersecurity incident response strategies and tactics.
Read in the filing ↗ Also in 10-K of Feb 14, 2025
We are also subject to an increasing number of reporting obligations in respect of material cybersecurity incidents. These reporting requirements have been proposed or implemented by a number of regulators in different jurisdictions, may vary in their scope and application, and could contain conflicting requirements. Certain of these rules and regulations may require us to report a cybersecurity incident before we have been able to fully assess its impact or remediate the underlying issue. Efforts to comply with such reporting requirements could divert management’s attention from our cybersecurity incident response and could potentially reveal system vulnerabilities to threat actors. Failure to timely report cybersecurity incidents under these rules could also result in regulatory investigations, litigation, monetary fines, sanctions, or subject us to other forms of liability.
Read in the filing ↗ Also in 10-K of Feb 12, 2026
We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents. While prior incidents have not been material and have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the reputational, operational, legal or financial impacts that may result. For additional information regarding risks from cybersecurity threats, see “Item 1A. Risk Factors - Risks Related to our Information Technology, Cybersecurity and Data Protection” in this Annual Report.
Read in the filing ↗ Also in 10-K of Feb 12, 2026
Our CISO, in conjunction with other digital & technology leaders, implements and oversees processes for the regular monitoring of our information systems. This includes escalation protocols to identify, assess and escalate cyber incidents. We also deploy security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, our CISO is equipped with a defined incident response plan. Our CISO meets quarterly with our risk management team and provides quarterly reports to the Audit Committee.
Read in the filing ↗ Also in 10-K of Feb 12, 2026
The Audit Committee is responsible for evaluating and overseeing the management of risks related to information technology, which includes cybersecurity risks. The Audit Committee receives quarterly reports from our Chief Information Security Officer (CISO) regarding cybersecurity matters and related risk exposures. The Audit Committee Chair regularly updates the Board on such matters and the Board also periodically receives reports from management directly. Our Board escalation protocols require material cybersecurity incidents or data breaches to be reported to the Board on a real-time basis.
Read in the filing ↗ Also in 10-K of Feb 14, 2025