Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
We do not have any unresolved comments from the SEC staff.
Item 1C. Cybersecurity
Overview
Criteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic
process for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information
Security Officer (“CISO”) , who reports directly to our Chief Technology Officer (“CTO”), who is responsible for managing
cybersecurity risks as well as protecting our products, networks and systems. Our CISO has extensive information
technology and program management experience and has served many years in our corporate information security
organization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security
engineering, incident response, compliance, and software development.
Governance
Our Board of Directors is primarily responsible for the oversight of our risk management activities and has delegated to
the Audit Committee the responsibility to assist in this task.
The Audit Committee regularly reviews and discusses with management and, as appropriate, the Company’s auditors, the
Company’s guidelines and policies with respect to risk assessment and risk management, including the Company’s data
privacy and cybersecurity risk exposures and the steps taken to monitor and manage those exposures.
The CISO helps maintain a comprehensive security program that serves as a governance framework for information
security at Criteo, supports the business goals of the company and details, across problem spaces and security core
functions, the various initiatives, their scope, the associated risks and weaknesses, the roadmap and the current progress.
Criteo assesses and manages its cybersecurity risks in part through an executive committee referred to as t he
Governance Risk and Compliance Committee (the “GRCC”). The GRCC is composed of the CISO and certain members
of our executive and leadership teams, and meets several times a year to discuss strategic information security matters
including the security program, major risks and incidents and significant key performance indicators (“KPIs”).
As a member of the GRCC, the CISO briefs the Audit Committee on the information security program, major risks and any
cybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board of Directors,
at least annually, as part of Criteo’s enterprise risk mapping (“ERM”) program.
Quality Control of Security
To help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and
remediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third-
party expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and
Technology (“NIST”) Cybersecurity Framework, International Organization for Standardization 27001 Information Security
Management System Requirements (“ISO27001”) and the American Institute of Certified Public Accountants’ Service
Organization Control Type 2 (“AICPA SOC 2”). Various parts of our business maintain independently assessed security
certifications, and we also run certification programs to expand the scope of our existing security certifications .
Risk Management
Our security team has several touch points within the business in order to adequately address and mitigate risks. For
instance, the team provides mandatory cybersecurity awareness training for all employees and a recurring phishing
campaign. Our technical security teams use a combination of threat intelligence tools, defensive tools and proactive
testing to detect vulnerabilities and respond. Our technical security teams also invest in building new tools and integrating
solutions to improve our security posture on an ongoing basis.
37
Our security compliance teams perform third-party risk assessments , respond to client inquiries about security, help the
business to manage our security controls, and translate our external requirements into policies, standards, and actions for
the rest of our business. Various parts of our team also participate in risks assessments during project kick-offs.
With regards to third-party risk assessments, our process involves assessing how third parties interact and connect with
our information systems and our data, assessing the security of the third-party (including through questionnaires), and
obtaining independent proofs of security (including via security certification and/or penetration tests) depending on the
associated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not
sanctioned or otherwise identified as potentially corrupt.
The process of assessing, identifying and managing cybersecurity related risks is integrated into our overall ERM via a
dedicated Information Security Risk Management program that is focused on cybersecurity risk and run by our security
compliance team. Risks that are identified through our security processes go through a process of analysis, prioritization,
treatment and monitoring. During the lifecycle of cybersecurity specific risks, risk owners, working alongside the security
compliance team, are assigned to develop risk mitigation plans, which are followed by the team until a risk is sufficiently
mitigated or resolved, at which point such risk reaches a monitoring state. Cybersecurity risks are aggregated into
strategic business risks and incorporated into the ERM program.
Cybersecurity Incidents
While we have experienced cybersecurity incidents in the past, there have been none to date which have materially
affected, or are reasonably likely to materially affect, the Company, our financial position, results of operations and/or cash
flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and
processes, which are designed to help protect our systems and infrastructure, and the information they contain.
For more information regarding the risks we face from cybersecurity threats, please see “Item 1A. Risk Factors – Risks
Related to Data Privacy, Intellectual Property and Cybersecurity.”