Company: CENX
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000949157-25-000024
Chunk: 58

Company: CENTURY ALUMINUM CO
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 58
---
 scheduled meetings, the Board and the Chief Information Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board’s oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board conducts an annual review of the company’s cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

Risk Management Personnel

Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Chief Information Officer. The Chief Information Officer has extensive experience working in and leading the Company's information systems. In addition, a dedicated Cybersecurity team, including the Chief Technology Officer and Cybersecurity Manager, provide regular updates to the Chief Information Officer.

Monitor Cybersecurity Incidents

The Chief Information Officer is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Chief Information Officer implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

Reporting to Board of Directors

The Chief Information Officer, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Executive Officer (CEO) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

25