Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
We rely on information technology systems across our operations, including for management, supply chain and financial information and various other processes and transactions. Our ability to effectively manage our business depends on the security, reliability and capacity of these systems. We maintain a comprehensive cybersecurity program to proactively assess our controls, identify and manage risks, and evaluate the overall effectiveness of our information security framework.
Our program is designed to support the confidentiality, integrity, and availability of our systems and data. We utilize internal and external security services to detect potential threats, conduct periodic third-party security assessments, and
28
provide cybersecurity awareness training for employees. We maintain an incident response plan to address cybersecurity incidents and maintain cybersecurity insurance. Such coverage may not fully cover potential losses.
The oversight of our cybersecurity risk management process is integrated into our overall risk management process. Through our enterprise risk management process, which involves a broad cross-functional group across many areas of expertise and is structurally independent of our business lines, we identify and assess risk and risk-mitigation actions, including with respect to cybersecurity risks.
We rely on third-party service providers to execute certain business processes, maintain certain information systems and infrastructure, evaluate defenses, and implement recommendations. We periodically have external information security assessments performed by third parties to analyze our internal assessment results and to stay informed of information security risks. Additionally, we maintain a supplier validation process, which involves approval by our cybersecurity group for significant suppliers that will have access to any of our databases or technology.
While we have experienced cybersecurity incidents in the past, as of the date of the filing of this Annual Report, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents have had, or are reasonably likely to have, a material effect on the Company, including our business strategy, results of operations or financial position. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see “Risk Factors - Risks Relating to Our Company and Business.”
Governance
The Board of Directors is responsible for overseeing risk for the Company and carries out its oversight of cybersecurity risk management with the assistance of the Audit Committee and the Information Security Committee , a management committee comprised of our Chief Financial Officer, Chief Group Services, Chief Technology Officer, Chief Operation Officer Europe, Chief Executive Officer Europe, Chief Information Officer ("CIO") , Chief Supply Chain Officer, Chief Information Security Officer ("CISO") , and Data Protection Officer. On a regular basis, the Information Security Committee reviews how we are executing against our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol. Our CISO is the member of our Information Security Committee who is responsible for overseeing our cybersecurity program, in partnership with the business leaders across the company. Our CISO is a certified and experienced information system security professional and reports directly to our CIO.