Equifax Inc.
Sustainability Accounting Standards Board (SASB) Index
Equifax supports the goals of the Sustainability Accounting Standards Board (SASB) standards to provide transparency andcommunicate important sustainability information to our investors and other stakeholders. Through our continued investor
engagement, we understand that the SASB standards represent an important tool for investors to analyze and evaluate companies.
Equifax is making our initial SASB disclosure. We are proud to take this important step and plan to continue to review and enhance
our disclosure going forward based in part on our ongoing engagement with investors.
Equifax is included under SASB’s Professional and Commercial Services industry category and our disclosure below addresses thetopics and metrics associated with that industry.

Table 1. Sustainability Disclosure Topics & Accounting Metrics
Data Security
Accounting Metric

Code

Description of approach toSV-PS-230a.1
identifying and addressing data
security risks

Response
The Audit Committee and Technology Committee of the Board of Directors
coordinate on cybersecurity risk oversight. As discussed in the Company’s
2021 Proxy Statement:… the Audit Committee and Technology Committee coordinate
on risk management oversight with respect to cybersecurity,including through quarterly joint committee meetings that cover
the following topics:● Regular reports from the internal audit department
regarding the security and technology portions of theinternal audit plan1

●●●Regular reports from our CISO and CTO regarding thecybersecurity
controlenvironment,including
remediation updates, compensating controls analyses
and other recurring items
Regular reports from our SVP for Enterprise Risk andCompliance regarding our risk and complianceprogram, including our compliance with obligations
under agreements to settle litigation matters and certain
federal and state government investigations arising outof the 2017 cybersecurity incident
Periodic updates from the Chief Privacy and Data
Governance Officer regarding developments related toour global privacy program

Additionally, Equifax has developed a cyber audit framework for the Board to
more effectively assess and address cybersecurity issues (see discussion in
the 2019 Proxy Statement). The full Board participates in annual tabletop
crisis management simulation exercises and/or training with management.
We implemented a cybersecurity performance measure into ourcompensation program which, beginning in 2018, is one of the metrics used toevaluate performance of all employees, including executives, under theAnnual Incentive Program. The assessment and cybersecurity performancemeasure are discussed in more detail in the Company’s 2018, 2019, 2020,and 2021 Proxy Statements.
In 2018, Equifax began a three-year transformation of our security program.
As part of the transformation, the Company undertook a process to improvethe efficiency, operability, and effectiveness of our Information Security2

Program (see 2020 Security Annual Report 1 and discussion of “refining oursecurity policies and technical standards” in the 2019 Proxy Statement). Our
comprehensive Information Security Program controls are aligned to theNational Institute of Standards and Technology (NIST) CybersecurityFramework (CSF) and NIST Privacy Framework (PF).2 Today, five capabilities– cybersecurity, privacy, fraud prevention, crisis management, and physicalsecurity – are represented in the Company’s unified controls framework andcomprehensive security program.
On an annual basis, the Board of Directors performs an enterprise risk
assessment which considers privacy and data security (includingcybersecurity) risks. As discussed in our 2020 Proxy Statement:
On an annual basis, the Board performs an enterprise risk
assessment with management to review the principal risks andmonitors the steps management is taking to map and mitigate
these risks● The Board then sets the general level of risk
appropriate for the Company through business strategy
reviews● Risks are assessed throughout the business, focusing
on (i) financial, operational and strategic risks, and (ii)ethical, legal, privacy, data security (including
cybersecurity), regulatory and other compliance risks
Equifax has multiple additional processes to assess, rate, and manage risks
that could result in the loss of confidentiality, integrity, or availability of Equifax

1Equifax 2020 Security Annual Report, https://assets.equifax.com/newsroom/2020-security-annual-report.pdf“Equifax Takes Leadership Stand With Early-Adoption Of Privacy Framework,” 28 January 2020,
https://investor.equifax.com/news-and-events/press-releases/2020/01-28-2020-215935971 and Equifax 2020 Security Annual Report, 5 May 2021,
https://assets.equifax.com/newsroom/2020-security-annual-report.pdf
23

assets or consumer data. These include completing an annual risk
assessment for the Information Security Program as well as risk rating andrisk assessment processes for individual applications and third parties (e.g.,suppliers).
Equifax previously announced our adoption of the NIST Cybersecurity
Framework.3 As outlined in the framework, the Company reviews both
external and internal threats, analyzes potential business impacts andlikelihoods, and uses threats, vulnerabilities, likelihoods, and impacts todetermine risk.4
Additional details regarding Equifax’s commitment to data security can befound at https://www.equifax.com/about-equifax/security/ and in the 2020
Security Annual Report available at https://www.equifax.com/securityreport.
Description of policies andpractices relating to collection,
usage, and retention ofcustomer information

SV-PS-230a.2

Privacy Principles
Equifax focuses on five key privacy principles: (1) Quality, (2) Stewardship, (3)Discretion, (4) Partnerships, and (5) Designing for Privacy.
Transparency and Control
Equifax is committed to providing transparency over our collection, use, andsharing of data, and providing consumers with greater control over their data.
For our United States business, we’ve consolidated most of our privacy
policies into a unified Equifax Privacy Statement. This comprehensive privacy
statement discusses how we collect, use, and share data across all of ourbusinesses, and provides greater detail over the types of data we collect.

3“Equifax Takes Leadership Stand With Early-Adoption Of Privacy Framework,” 28 January 2020,
https://investor.equifax.com/news-and-events/press-releases/2020/01-28-2020-215935971
4
National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), https://www.nist.gov/cyberframework/framework

4Individuals outside the United States can refer to the privacy statements fortheir country on our country-specific websites.
Effective Governance
We are committed to embedding privacy into all aspects of our business, andwe believe that commitment should be transparent and accountable. That’s
why we’ve publicly committed to being an early adopter of the National
Institute of Standards and Technology (NIST) Privacy Framework, a
best-in-class privacy tool to help identify and manage privacy risk to build
innovative products and services while protecting individuals’ privacy.5
Equifax maintains privacy policies covering our global operations which
include:● US: Equifax Privacy Statement6● UK: Equifax Information Notice,7 Credit Reference Agency Information
Notice (CRAIN), and the Equifax Website, Cookies and Consumer
Services Privacy Policy.8● Canada: Canada Privacy Policy9● Australian/New Zealand: Equifax Privacy Policy10● Argentina: Terminos y condiciones de Equifax11● Paraguay: Política de Privacidad12● Chile: Términos y Condiciones de Compra los Productos / Servicios
Equifax en el Sitio Web www.Equifax.cl13
5“Equifax Takes Leadership Stand With Early-Adoption Of Privacy Framework,” 28 January 2020,
https://investor.equifax.com/news-and-events/press-releases/2020/01-28-2020-215935971
6
Equifax Privacy Statement, April 2020, https://www.equifax.com/privacy/privacy-statement/
7
Equifax Information Notice, May 2020, https://www.equifax.co.uk/ein.html
8Equifax Website, Cookies and Consumer Services Privacy Policy, May 2020, https://www.equifax.co.uk/About-us/Privacy_policy.html
9Equifax Privacy Policy, September 2018, https://www.consumer.equifax.ca/privacy/
10
Equifax Privacy Policy (Australia), https://www.equifax.com.au/privacy
11
Equifax Veraz Terminos y condiciones de Equifax, https://www.soluciones.equifax.com.ar/legal#PrincipiosB%C3%A1sicos
12
Equifax Política de Privacidad, https://soluciones.equifax.com.py/privacy_policy
13
Equifax Derechos de los Consumidores, https://soluciones.equifax.cl/legal

5

●
●
●
●
●
●
●

Ecuador: Política de Privacidad14
Honduras: Política de Privacidad15
El Salvador: Política de Privacidad16
Costa Rica: Política de Privacidad17
Mexico: Aviso de Privacidad18
India: Privacy Policy19
Spain: Política de Privacidad y Cookies20

Additional details regarding Equifax’s commitment to privacy can be found athttps://www.equifax.com/privacy/.
(1) Number of data breaches,(2) percentage involving
customers' confidential
business information (CBI) or
personally identifiable
information (PII), (3) number ofcustomers affected

SV-PS-230a.3

Equifax complies with all legal, regulatory, and other applicable industry
requirements involving customers' confidential business information (CBI) or
personally identifiable information (PII). Except as a matter of public record,
Equifax does not disclose this information.

14

Equifax Política de Privacidad, https://www.equifax.ec/privacy_policy
Equifax Política de Privacidad, https://www.equifax.hn/legal
16
Equifax Política de Privacidad, https://www.equifax.sv/legal
17
Equifax Política de Privacidad, https://www.equifax.co.cr/legal
18
Equifax Aviso de Privacidad, https://www.equifax.com.mx/es/privacidad
19
Equifax Privacy Policy, https://www.equifax.co.in/privacy-policy/en_in
20
Equifax Política de Privacidad y Cookies, https://soluciones.equifax.es/legal#Privacy
15

6

Workforce Diversity & Engagement
Accounting Metric

Code

Percentage of gender andSV-PS-330a.1
racial/ethnic grouprepresentation for (1) executivemanagement and (2) all otheremployees

Response
Category21

2020

Women Senior Leaders22 (Global)

31%

Women (Global)

45%

Black Senior Leaders (US)5%Black (US)17%

Hispanic Senior Leaders (US)4%

Hispanic (US)5%

Asian Senior Leaders (US)17%

Asian (US)18%

Other23 Senior Leaders (US)1%

Other (US)2%

Total Minority Senior Leaders (US)27%

Total Minority (US)

42%

21

Race and ethnic diversity includes US demographic information only. Gender data is based on global workforce consistent with EEO reporting.
“Senior Leaders” include all employees with roles at Management Band 4 and above.
23“Other” category includes the following demographics: American Indian or Alaska Native, Native Hawaian or other Pacific Islanders, and Two orMore races.
227

(1) Voluntary and (2)involuntary turnover rate foremployees

SV-PS-330a.2

Employee engagement as apercentage

SV-PS-330a.3

Voluntary Turnover Rate24

12%Involuntary Turnover Rate

5%

Employee Engagement

NA25

Professional Integrity
Accounting Metric

CodeResponse

Description of approach toensuring professional integrity

SV-PS-510a.1

To meet our ethics and compliance responsibilities, Equifax maintains a Codeof Ethics and Business Conduct. Our Code of Ethics and Business Conduct
provides guidance on each team member’s personal responsibility andexpectations of all Equifax employees, which includes complying with the lawsin every market we operate in and also applying our good judgment ineverything we do, each and every day.
The Equifax Code of Ethics and Business Conduct addresses topics such as(1) our commitment to ethics and compliance, including the Equifax integrity
Line, (2) respect and integrity in the workplace, including diversity andnon-discrimination, (3) maintaining appropriate business relations, (4)protecting our information and assets, and (5) following the letter and spirit ofthe law.
The Equifax Code of Ethics and Business Conduct is provided to all new hires
and all Equifax employees must certify their review and understanding of, andagreement to abide by the terms and conditions of the Code each year.
Additional details regarding Equifax’s approach to ensuring professional
responsibility can be found in the full Code of Ethics and Business Conduct,2425

Equifax uses global workforce data to calculate turnover rate.
No comprehensive employee survey conducted during this time; employee engagement survey focused primarily on COVID-19 topics.

8

which is available at:https://assets.equifax.com/assets/corp/code_of_ethics.pdf.
Total amount of monetarylosses as a result of legal
proceedings associated withprofessional integrity

SV-PS-510a.2

Any material legal proceedings for the company are disclosed under “Item 3.
Legal Proceedings” in our Form 10-K and Form 10-Qs, filed with the SEC.

Activity Metric

CodeResponse

Number of employees by: (1)full-time and part-time, (2)temporary, and (3) contract

SV-PS-000.A

Table 2. Activity Metrics

Employee hours worked,
percentage billable

SV-PS-000.B

Category

2020

Full-Time and Part-Time

11,621

Temporary258

Contract

10,021

Employee hours

45,622,876 annualized

Percentage billable

NA

Last updated: October, 2021
You should assume that the information appearing in this webpage is accurate only as of the date it was last updated.

9