Company: ADP
Filing Date: 2025-08-06
Form Type: 10-K
Source: 0000008670-25-000037
Chunk: 46

Company: AUTOMATIC DATA PROCESSING INC
Filing Date: 2025-08-06
Form: 10-K
Item: Item 1C
Chunk 46
---
 board of directors and external advisors, as appropriate. We test our plans and processes through simulation exercises, scenario planning and tabletop exercises, using findings to improve processes. •External and Internal Assessments. We periodically engage assessors, consultants, auditors, and other third parties to evaluate our technology, security, and related controls and benchmark against industry practices. We engage in both internal and external assurance and audit activities across the company multiple times a year including an annual third-party review of our overall cybersecurity program. •Threat Intelligence. We maintain affiliations with cybercrime task forces and other third-party monitoring organizations. In addition, we collaborate with professional security organizations, law enforcement and technology companies to proactively identify malicious activity.•Business Resiliency Program.  We have established a global, integrated business resiliency program designed to manage the impacts of technological, environmental, process and health risks on service delivery. This program uses an integrated framework that lays out our mitigation, preparedness, response and recovery process.  •Third-Party Risk Management. We maintain a third-party risk management process, designed to identify and manage risks associated with our vendors, our partners and other third parties, that includes conducting security assessments prior to engagement and periodically during the engagement. We also seek to include security and privacy terms, where appropriate, in our contracts with third-party service providers that require third parties to maintain security controls to protect our data and notify us in the event of a cybersecurity incident.•Security Awareness and Training Program.  Our security training and awareness program is a continuous, dynamic initiative, designed to develop and maintain a security-focused culture and empower our associates to make responsible, secure decisions. As part of this awareness program, we communicate to our associates on a regular basis regarding key security topics and current events, best practices for addressing such cybersecurity threats, and 

24

gamification to reinforce effective behaviors. All associates are also required to take an annual, interactive security training program that includes an overview of key security topics, policies and responsibilities. We have also integrated cybersecurity related risks into our enterprise risk management program, which is designed to identify, prioritize, assess, monitor and mitigate the various risks confronting ADP, including cybersecurity risks. Our enterprise risk management team conducts a range of activities, including an annual enterprise risk management assessment.

We have been, and continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, and denial of service. Although we believe that we maintain a robust program of information security and controls and none of the cybersecurity incidents that