Company: PRMB
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0002042694-25-000003
Chunk: 189

Company: Primo Brands Corp
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 189
---
ITEM 1C.CYBERSECURITY

Cybersecurity Risk Management, Strategy and GovernanceThe Company maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through comprehensive security measures including our technology tools, internal management and external service providers.The Company’s Chief Information Security Officer (“CISO”) is responsible for assessing, identifying, and managing our risks from cybersecurity threats. This individual has over 30 years of experience in information security positions. Our CISO holds the Certified in Risk and Information Systems Control ("CRISC") certification from the Information Systems Audit and Control Association, a leading independent cybersecurity association. Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee holds periodic discussions with management regarding the Company’s guidelines and policies with respect to cybersecurity risks and receives regular reports regarding such risks and the steps management has taken to monitor and control any exposure resulting from such risks. Our CISO also leads an annual review and discussion with the full Board of Directors dedicated to the Company’s cyber risks, threats, and protections and provides updates throughout the year, as warranted.We have processes and a risk-based approach that align with the National Institute of Standards and Technology Cybersecurity Framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, encryption and access control, and employee training. The CISO reviews emerging threats, controls, and procedures as part of assessing, identifying, and managing risks. This review aids in the identification of material breaches at other companies, including our third-party service providers. The CISO also discusses trends in cyber risks and our strategy to defend our information against cybersecurity incidents with our Audit Committee and executive leadership team on a regular basis, in addition to the annual review and discussion with the full board.In addition to our dedicated information security and technology teams monitoring our daily operations, we engage independent third-party cybersecurity providers for managed systems security, endpoint detection and response, and threat and vulnerability management. Regular communication with these providers aids in the identification and remediation of potential threats, and we regularly review our relationships with and services from these providers against industry standards and evolving cybersecurity threats.We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness trainings and supplemental trainings as needed. All employees undergo annual training and there are additional trainings for certain roles and functions. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.

40

Table of Contents

Material cybersecurity incidents are required to be reported to