Company: CRAI
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001053706-25-000007
Chunk: 62

Company: CRA INTERNATIONAL, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 62
---
Item 1C.    Cybersecurity

Our cybersecurity program and policies establish the responsibilities of individuals and committees tasked with oversight of security risk management and provide broad directives that support implementation for identifying, assessing and managing risks from cybersecurity threats. We conduct an annual information security risk assessment which includes a review of the organization’s performance of administrative, technical and physical safeguards protecting personal and confidential information. Information security related policies are reviewed on an annual basis and approved by the owners of each functional area.We engage independent third-parties to conduct ethical hacks of key systems, aiding our understanding of control effectiveness and facilitating the implementation of more robust controls. We periodically engage with a third-party assessment firm to conduct reviews of our overall program and to examine our security controls to help us better align our cybersecurity 

19

Table of Contents

program with industry standards. To monitor and decrease the risks from cybersecurity threats associated with our use of third-party service providers, potential new vendors with a greater degree of system or data access are subjected to a security vetting process prior to engagement. Existing critical vendors that store or process company or client information are reviewed annually through commercially reasonable efforts such as questionnaires.

Management and Board Oversight

Our management is responsible for the day-to-day management of the risks that we face, while our Board of Directors, as a whole, has responsibility for the oversight of our enterprise risk management, including cybersecurity. Under the oversight of the Board of Directors, cybersecurity risk is managed under the direction of our Information Security department, the Information Security Council ("ISC") and the Enterprise Risk Committee (“ERC”). The ISC is a standing committee that acts as a point of escalation for security incidents and is headed by our Chief Information Officer (“CIO”). Our CIO has over 20 years of experience in the IT field, holds a Bachelor of Science in Information Systems and is Microsoft Certified Solutions Expert (MCSE) certified. Other members of the ISC include IT senior leadership, IT operations and corporate management and a member from our Forensic & Cyber Investigations practice. Other members of the ISC have work experience related to information security issues and/or hold industry certificates, including Certified Information Systems Security Professional (CISSP). The ERC is a standing committee providing oversight on overall enterprise risk. The ERC is chaired by our Chief Legal Counsel and is composed of representatives from senior management. The Board of Directors receives regular updates and reports from members of senior management regarding our cybersecurity risks and protection measures, including any notable cybersecurity incidents, and evaluates risks posed by cybersecurity threats. 

Processes for Assessing, Identifying and Managing Material