Company: VRT
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0001628280-25-005905
Chunk: 213

Company: Vertiv Holdings Co
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1
Chunk 213
---
 assessing and managing our material risks from cybersecurity threats is documented in the Company’s IT and Cybersecurity Risk Management Strategy Plan (our Cybersecurity Plan), and our processes for identifying, assessing, prioritizing, and remediating vulnerabilities are documented via our Cybersecurity Plan (and the documents referenced therein) and our IRP. Our management cybersecurity team consists of a majority of the direct reports to our CEO, including our CIO, as well as dedicated cybersecurity personnel – including without limitation, our CISO, multiple cybersecurity engineers and other business level stakeholders. Although there is overlap between the CROC and our management cybersecurity team, the CROC is intended to function as a proactive group to assess and treat risks prior to an incident occurring and the cybersecurity management team is tasked with responding to threats or incidents. In connection with and pursuant to our enterprise risk management plan, our cybersecurity team, the CROC and our ERC work collaboratively across the Company to implement programs and processes designed to protect our information system from cybersecurity threats, assess and manage risks arising from any such threats, and to promptly respond to cybersecurity incidents. Upon the discovery of a potential or actual cybersecurity incident, the detecting party is obligated to inform the CISO, or deputy CISO if the CISO is unavailable, as an initial step. We also employ the services of an outside vendor that is tasked with contacting the CISO, or the CISO’s delegee, upon learning of an incident. Subsequently, our CISO will guide the initial analysis of the cybersecurity incident, and depending on the nature of the incident, these cybersecurity incidents may be escalated to our CIO and above according to the guidelines set forth in the IRP. Analysis of the potential impact of the cybersecurity incident is one of the primary objectives of our initial response. Once the severity level and appropriate management protocol for responding to the cybersecurity incident have been determined in accordance with our Cybersecurity Plan and IRP, the CIO, or the CIO's delegee, may elevate the incident to the CEO, Chief Legal Counsel, Board, and Audit Committee as needed (depending on the nature and severity of the incident) for further investigation and 

33

response, including for an assessment of materiality. Depending on the nature of the incident, the CIO or Chief Legal Counsel will coordinate a notification and communications plan and event analysis across the appropriate teams, which may involve updates to our cybersecurity management team, the Board, the Audit Committee, the ERC and the CROC. Relevant Expertise of Management: Our CISO has more than