Company: GPI
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0001031203-25-000013
Chunk: 105

Company: GROUP 1 AUTOMOTIVE INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 105
---
Item 1C. Cybersecurity

Description of Processes for Assessing, Identifying and Managing Cybersecurity Risks

In the ordinary course of business, our information systems on which we run our business operations and store confidential or proprietary data, such as PII about our customers and our employees, are subject to potential cyber-attack. The techniques used by cyber attackers change frequently and may be difficult to detect for long periods of time. See Item 1A. Risk Factors for additional information about the risks to our business associated with a breach or compromise to our IT systems. We have implemented security measures that are designed to detect and protect against cyberattacks. Our processes and procedures align with the National Institute of Standards and Technology Cybersecurity Framework. In particular, we seek to assess, identify and manage cybersecurity risks through the processes described below:Risk Assessment A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Regular assessments and testing of our cybersecurity safeguards are conducted by independent third-party cybersecurity experts. Our internal audit department additionally conducts regular audits to assess management’s processes and controls employed to identify and manage material cybersecurity risks. We use a variety of layered applications to alert us to suspicious activity. 

22

Incident Identification and ResponseA security information and event management process (“SIEM”) has been implemented to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have an incident response plan within our SIEM that is designed to provide for action to contain the incident, mitigate the impact and restore normal operations efficiently. We conduct annual reviews of our cyber incident response plan. Cybersecurity Training and AwarenessCybersecurity awareness among our employees is promoted with regular training and awareness programs. Employees who access our systems are required to undergo annual cybersecurity training and, each year, employees are required to test their understanding of our cybersecurity policies. Further, our employees that handle PII are required to undergo training, including phishing exercises and awareness programs on the appropriate management, use and protection of that information.Access ControlsWe have endeavored to implement physical access controls to prevent access to endpoints that may leave Company data vulnerable to attack. We have also sought to implement systems to prevent encrypted information from bypassing certain Company-defined information control mechanisms and have also sought to purge or wipe information from certain Company-defined endpoints after consecutive, unsuccessful logon attempts or other indicators of unauthorized access. Finally, we have implemented encrypted virtual private networks in an effort to enhance the integrity of remote connections and have endeavored to protect wireless access points to our systems using authentication of users