Company: SPH
Filing Date: 2025-11-26
Form Type: 10-K
Source: 0001193125-25-298630
Chunk: 16

Company: SUBURBAN PROPANE PARTNERS LP
Filing Date: 2025-11-26
Form: 10-K
Item: Item 1B
Chunk 16
---
None.

ITEM 1C.	CYBERSECURITYCybersecurity Risk Management and StrategyOur cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats as well as effective management of security risks and resiliency, with the goal of preventing, or mitigating, any cybersecurity incidents.  Our processes for managing cybersecurity risks include the use of technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats.  We utilize risk-based controls in seeking to protect our information, information regarding our customers, vendors, employees, and other third-parties, our information systems, our business operations, and our products and related services.  We have adopted security-control principles based on the NIST Cybersecurity Framework.  Our program is comprehensive in scope and covers all of our general corporate IT systems, as well as operational technology systems supporting our businesses. When engaging third-party service providers, we also evaluate the sufficiency of the security of the technology systems used by our third-party service providers.  Our senior leadership team, along with the Audit Committee of our Board of Supervisors, receive regular and recurring program updates, metrics, and roadmaps to assist us in overseeing and promoting the effectiveness of the program and its alignment with our business objectives.  Our program and controls are periodically reviewed and tested by independent third-parties to enable us to employ industry best practices.Our cybersecurity risk management program includes an incident response plan (“IRP”).  Our IRP provides us with a plan for identifying, responding to, reporting and remediating cybersecurity incidents.  Our IRP has been established to reduce or minimize the impact of cybersecurity incidents on our networks, IT systems, users or business processes.  Our Information Services Breach Response Team (“ISBRT”) takes a central role in developing and maintaining our incident response framework in coordination with our Cybersecurity Response Team (“CRT”) that is dedicated to proactively addressing and managing potential breaches and incidents to ensure that our cybersecurity defenses are well designed and managed.  Our Incident Management Team (“IMT”) handles the response process for all cybersecurity incidents.Our cybersecurity risk management program and strategy also includes:•a continuous vulnerability management process to monitor and identify threats in our environment, including our IT networks and legacy systems, that could potentially have a materially adverse impact on our critical systems, information protection and broader enterprise IT environment;•the use of reputable cybersecurity consultants and other experienced third-party experts