Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
30
Table of Contents
Item 1C. Cybersecurity
Cybersecurity risk management and strategy
We maintain a cybersecurity program designed to protect our systems and data from information security risks, including regular oversight of our programs for security monitoring. Gen has a process for identifying and assessing material risks from cybersecurity threats on a regular basis that operates alongside our broader overall risk assessment process, covering all identified enterprise wide risks. Cybersecurity risk is reviewed quarterly with management and with the board of directors. In addition, we regularly perform evaluations (including independent third-party evaluations) of our security program and our information technology infrastructure and information security management systems. A retained independent third-party firm reviews the maturity of our information security program and the results are discussed with the Audit Committee of the Board. Our processes also address the identification, assessment, and management of cybersecurity threat risks from our use of third-party service providers and other external vendors that support our products, services and internal operations . This involves, among other things, conducting pre-engagement risk-based diligence, reviewing security and controls reports, implementing contractual security and notification provisions, and ongoing monitoring and periodic assessment, as appropriate, based on the nature of the services provided and changes in the threat environment.
Our information security management system is based upon industry frameworks including but not limited to ISO 27001 and NIST Cybersecurity Framework. Our Chief Information Security Officer (CISO) leads our cybersecurity program, which includes the implementation of controls designed to align with these industry frameworks and applicable statutes and regulations. Our CISO has over 30 years of prior work experience in various roles involving managing information security programs, developing cybersecurity strategy, implementing effective information and cybersecurity initiatives and has been the Head of IT Audit, CISO and CIO at three other companies prior to Gen Digital. He has a Bachelor of Science in Computer Information Systems. We have implemented security monitoring capabilities designed to alert us to suspicious activity and developed an incident response program that includes an annual table top exercise and is designed to restore business operations quickly. In addition, employees participate in mandatory annual training and receive communications regarding the cybersecurity environment to increase awareness throughout the company. We also implemented an enhanced annual training program for specific specialized employee populations, including secure coding training.
Governance
The Audit Committee of the Board has direct oversight to the Company’s (1) technology strategy, initiatives, and investments and (2) key cybersecurity information technology risks against both internal and external threats. The Audit Committee of the Board is comprised entirely of independent directors, with a mix of experience related to information technology audits, information security issues and/or oversight who meets and reports to the Board on a quarterly basis. The Audit Committee considers information technology risks in connection with cybersecurity incidents overseeing our enterprise technology, and reports to the Board on enterprise risk management matters on a quarterly basis. We have processes in place for management to report security instances to the Audit Committee as they occur, if material, and to provide a summary multiple times per year of other incidents to the Audit Committee. Additionally, our CISO attends each Audit Committee meeting and meets regularly with the Board of Directors to brief them on technology and information security matters. We carry insurance that provides protection against some of the potential losses arising from a cybersecurity incident. In the last fiscal three years, we have not experienced any material information security breach incidences and the expenses we have incurred from information security breach incidences were immaterial. This includes penalties and settlements, of which there were none.
We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Our solutions, systems, websites and the data on these sources have been in the past and may continue to be subject to cybersecurity events that could materially harm our reputation and future sales.” included as part of ”Risk Factors” in Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.