Company: GGG
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000042888-25-000011
Chunk: 38

Company: GRACO INC
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 38
---
Item 1C. Cybersecurity

Our cybersecurity program seeks to identify, assess and monitor material cybersecurity and other information technology risks and threats that may affect our information systems, networks and operations, including those systems and networks managed by third parties. We regularly assess potential risks and execute a layered cybersecurity strategy based on prevention, detection, mitigation, and remediation. The Company’s cybersecurity risks are evaluated at least annually through our enterprise risk management program, which is a company-wide effort to identify, assess, manage, report and monitor material risks that may affect our ability to achieve our business objectives.  

To manage our cybersecurity program, we have established a cross-functional cybersecurity oversight committee and cybersecurity team, both led by our Chief Information Officer ("CIO"). Our cybersecurity oversight committee and cybersecurity team, with the support of external cyber-specialist resources, include technical experts in cybersecurity risk management, incident response and security operations with extensive experience in the operations of networks, network security and infrastructure management. In addition, members of our cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. Our CIO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the cybersecurity management team and through the use of technological tools and software.Policies, procedures and controls under our cybersecurity program are designed in consideration of published frameworks, including the Center for Information Security ("CIS") Critical Security Controls, and routinely evaluated for ongoing adherence to those frameworks. Our cybersecurity program includes a process for incident response and continuous improvement. We periodically enlist outside advisors to evaluate the maturity of our cybersecurity program, review processes and policies, conduct penetration and vulnerability tests and simulation exercises, and to monitor and help identify potential cybersecurity incidents. We provide annual cybersecurity awareness training to our employees and contractors to help identify potential cybersecurity threats and attacks, perform targeted phishing campaigns, use multifactor authentication for secure access to our systems and networks and tabletop exercises to simulate and prepare for potential incidents. When considering to engage with third-party service providers, we assess the risks from cybersecurity threats posed by such engagement and continue to evaluate those risks throughout the duration of the relationship.    

The Audit Committee of the Board of Directors oversees the Company’s cybersecurity risks and strategy. Management provides regular updates to the Audit Committee on cybersecurity risks facing the Company, the systems management has in place to mitigate and manage those risks, the status of key cybersecurity initiatives through a review of the Company’s cybersecurity strategic roadmap and whether any material cybersecurity incidents have occurred. The Audit Committee performs an annual review of the