Company: BRSL
Filing Date: 2025-02-25
Form Type: 20-F
Source: 0001619762-25-000007
Chunk: 140

Company: Brightstar Lottery PLC
Filing Date: 2025-02-25
Form: 20-F
Item: Item 16K
Chunk 140
---
Item 16K. Cybersecurity

Cybersecurity Risk Management Processes

As discussed inPart I, Item 3. D - Risk Factors, the Company faces an evolving cybersecurity and information security risk landscape that could impact the achievement of strategic, financial and operational objectives. While it is not possible to identify or anticipate every cybersecurity and information security risk, the Company has developed, implemented, and maintained cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. These include processes for assessing, identifying, and managing material risks from cyber and information security threats, which are incorporated into the Company’s enterprise risk management program, an d we test, evaluate, and evolve our processes, security measures, and incident response, as appropriate.

To operate the business and provide products and services to our customers, the Company owns and maintains or works with third parties These information systems include physical or virtual infrastructure controlled by such information resources (or components thereof), organized and overseen by the Global Information Security (“ GIS”) team in collaboration with the business to collect, process, maintain, use, share, disseminate or dispose of the Company’s information to maintain and support operations.

GIS maintains information and cyber security risk management practices and processes designed to identify, analyze, evaluate and address various cybersecurity threats faced by the Company. Any potential cybersecurity incident could adversely affect the confidentiality, integrity or availability of our information systems or any information residing therein, and these threats include external attempts to breach and compromise systems, social engineering, insider threats, mishandling of or failure to comply with security policies and not adhering to published guidance on how to operate in accordance with cybersecurity practices.

GIS performs certain operational aspects of the information and cyber security program by partnering with business units and senior management to conduct ongoing impact and risk assessment. The GIS team serves as the Company’s first level of information and cyber security defense monitoring, with responsibility for identifying and escalating cybersecurity incidents pursuant to established internal procedures. When a cybersecurity incident occurs, GIS coordinates and provides timely, organized, and informed responses to mitigate the damage or loss to the Company’s IT systems, network and data and to minimize economic, reputational and other harms to the Company and its customers, employees and partners

Cybersecurity Governance and Oversight Responsibilities

To support the effectiveness of the information and cyber security risk management practices, the Company has implemented a program and governance model that describes the roles, responsibilities and expectations across the Company:

•Board and Audit Committee
: The Board

•Information and Cyber Security Program Owners: The Senior Vice