Company: CGC
Filing Date: 2025-05-30
Form Type: 10-K
Source: 0000950170-25-079317
Chunk: 17

Company: Canopy Growth Corp
Filing Date: 2025-05-30
Form: 10-K
Item: Item 1C
Chunk 17
---
The Company’s Audit Committee is responsible for overseeing the Company’s internal controls including oversight over our risk management program and cybersecurity. Management is responsible for the day-to-day administration of the Company’s risk management program and its cybersecurity policies, processes, and practices. The Company’s cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization and are standalone from the Company’s overall risk management system and processes. The Company seeks to address all material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company’s information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

Cybersecurity Risk Management and Strategy

The Company’s cybersecurity risk management strategy focuses on several areas:

•Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to identifying, and managing material cybersecurity threats and incidents. The Company’s program includes controls and procedures to properly alert, identify, scope, triage, escalate, contain, eradicate mitigate and recover from cybersecurity incidents by providing management visibility and to enable management to take action with respect to reporting of material incidents in a timely manner.

•Technical Safeguards: Our program consists of layered defenses to enhance resiliency within the system to prevent, detect and respond to any incidents. Our perimeter security includes but is not limited to, proactive threat intelligence via our security partners, firewalls, end-point security agents, email security, vulnerability assessments and scans, proactive patching, and privileged access management. Our detection capabilities include event logging and monitoring such as unsuccessful login attempts, escalated privilege attempts, anomaly detection. Our response capabilities are supplemented by a 3rd party breach response process through our insurer’s cyber panel, which includes access to a breach coach and forensic experts under a tripartite agreement to ensure coordinated response and maintain privilege; security playbooks setting forth a tactical guide to respond to cybersecurity events and threats as they occur; and recovery procedures.  We have also implemented various technical safeguards that are designed to protect the Company’s information systems from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications.

•Incident Response and Recovery Planning: The Company has established and maintains a comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company’s response to a cybersecurity incident. The