Company: UIS
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000746838-25-000008
Chunk: 64

Company: UNISYS CORP
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 64
---
ITEM 1C. CYBERSECURITY

Cybersecurity Risk Management and StrategyUnisys’ process for assessing, identifying and managing material risks from cybersecurity threats.Protecting information, including that of our clients, is a top priority. Our overall cybersecurity and privacy strategy is to protect our customers’ information and assets as well as ours to enable agility in the business. We have expertise, dedicated resources and technology to identify, assess, respond to and mitigate material risks from cybersecurity threats. Our Global Information Security organization (GIS), led by our Chief Information Security Officer (CISO), manages Unisys’ cybersecurity risk identification, detection, assessment, response, mitigation and remediation processes, and interfaces with other departments, including business units, the information technology and legal departments, and enterprise risk management, to facilitate the risk management processes and ensure the policies and procedures established by GIS are integrated into our overall enterprise risk management system. GIS processes also work in tandem with the processes maintained by our Global Privacy Office (GPO). Through our GPO, we deploy functional and business unit-specific approaches to data and privacy compliance sharing threat intelligence daily and collaborate closely with the Corporate Information Technology (CIT) organization to build process and playbooks for cyber-resiliency. Taking into consideration the processes established by GIS and CIT, our GPO has developed a framework of policies, procedures and other initiatives that are implemented across Unisys to help meet data privacy requirements. Our GPO is supported by a network of data protection officers, attorneys and privacy specialists; and manages privacy software that is used across Unisys to facilitate privacy impact assessments. The GPO also records data processing activities, maps data flows and follows evolving privacy regulatory guidance for countries in which we operate and adjusts standards as necessary.Our dedicated cybersecurity incident response team, the Security Incident Response Team (SIRT), is comprised of internal resources and an external vendor, Managed Security Services Provider (MSSP). The MSSP triages and validates true positive events and then communicates to the internal SIRT team for deeper investigation and response.Our physical and technological cybersecurity controls include, among other items:•perimeter and endpoints firewalls, intrusion prevention systems, endpoint detection and response, Attack Surface Management, multi-factor authentication and email protection;•routine testing of and training on our IT systems, including test phishing emails and awareness training opportunities;•automation and alerts via embedded tools and procedures to monitor data and notify us of threats or other potential unauthorized occurrences on or conducted through our systems;•multiple mechanisms by which employees can report cybersecurity and