Company: PRGO
Filing Date: 2025-03-21
Form Type: DEF 14A
Source: 0000950170-25-042897
Chunk: 19

Company: PERRIGO Co plc
Filing Date: 2025-03-21
Form: DEF 14A
Chunk 19
---
 deploy cybersecurity technologies and educate associates on cybersecurity risks.

We maintain cyber insurance coverage to help mitigate possible costs associated with a potential incident.

We have implemented an information and cybersecurity awareness program designed to educate and test employee maturity at least annually, and regularly throughout the year employees receive training regarding phishing and other threat actor schemes, the inherent risks involved in human interaction with information and operational technology and new and emerging technologies.

We have processes in place designed to allow us to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers and suppliers through our Supplier Cyber Risk Assessment process, which assesses third-party cybersecurity controls through a combination of risk assessment questionnaires, commercially available risk data and security rating platforms. We also include cybersecurity and information security language in our contracts where applicable. We require our suppliers and partners report cybersecurity incidents to us so that we can assess the impact of such an incident on us and have dedicated processes to respond to cybersecurity incidents at third parties. We have established processes to contain the impact of potential security incidents on Perrigo's third party service providers.

Cybersecurity and Information Security Risk Governance

Our overall information security efforts are led by the Chief Information Security Officer ("CISO"). The CISO has substantial experience in cybersecurity, including knowledge, skills, certifications and background in the field. The CISO holds several key certifications including Certified Information Systems Security Professional ("CISSP"), Certified Secure Software Lifecycle Professional ("CSSLP") and Certified Ethical Hacker ("CeH").

While management is responsible for day-to-day risk management, the Board is responsible for the Company’s overall risk oversight function, including cybersecurity risks, and includes oversight by several committees. The NGC, comprised solely of independent directors, supports the Board by overseeing cybersecurity risks, policies and objectives. As a part of its duties, the NGC regularly provides reports to the full Board of Directors.

The NGC routinely engages with the Chief Financial Officer (“CFO”), the CISO and Senior Vice President, Information Technology and Services (“IT&S”) Strategy and Business Partnering on a range of cybersecurity-related topics, including threats to the environment and vulnerability assessments, policies and practices, technology trends and regulatory developments.

Perrigo has an incident response team comprised of the CISO and senior leadership from Legal, Human Resources and Finance. We have a formalized breach management protocol and playbooks that are tested periodically. Perrigo uses a panel of forensic and industry leading third-party service providers to assist the Company with its response in the event of a cybersecurity incident. This collaborative approach, working with a wide