Company: TTMI
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000950170-25-024839
Chunk: 84

Company: TTM TECHNOLOGIES INC
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1B
Chunk 84
---
None.

ITEM 1C. CYBERSECURITYWe depend on information systems and technology in substantially all aspects of our business, including communications among our employees and with suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including system disruption, security breach, ransomware, theft, espionage, and inadvertent release of information. Our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers’ and suppliers’ information, private information about employees, and financial and strategic information about the company and its business partners. Further, as we pursue new initiatives that improve our operations and cost structure, we are also expanding and improving our information technologies, resulting in a larger technological presence and increased exposure to cybersecurity risk. If we fail to properly assess and identify cybersecurity risks, we may become increasingly vulnerable to such risks.Cybersecurity risk management and strategyWe assess and identify security risk to the organization by:•conducting assessments of risk including likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems and the related information processes, stored, or transmitted;

34

•performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by IT senior leadership, including the Company’s Senior Vice President of Information Technology (SVP-IT);•ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended, and producing the desired outcome; and•periodically scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.We have established a continuous monitoring strategy and program, which includes:•a set of defined security metrics to be monitored;•performance of security control assessments on an ongoing basis;•addressing results of analysis and reporting security status to the executive team; and•monitoring information systems to detect attacks and indicators of potential attacks.Other processes in place to further manage any additional security risk to the organization include:•identifying, reporting, and correcting information system flaws, security alerts, and advisories;•monitoring inbound and outbound communications for unusual or unauthorized activity;•designing and implementing application systems to include sound backup and recoverability principles, such as periodic data backups in the case of a disaster;•mechanisms designed for the physical protection of IT resources; and•use of all third-party and cloud computing services are reviewed and evaluated for material risks of cybersecurity threats by the IT security department before being formally authorized for use. Use of services must comply with all laws and