Company: WCC
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000929008-25-000005
Chunk: 59

Company: WESCO INTERNATIONAL INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 59
---
, such as developers, platform administrators and finance personnel. We have instituted regular phishing, social engineering and other malicious attack simulations, generally at least once per quarter, to enhance our employees’ awareness and responsiveness to such possible threats. We run several awareness campaigns each year covering a variety of topical cybersecurity subjects and we maintain an internal website that is accessible to all employees that has security policies, additional trainings, and current news events. Our security policies and trainings are regularly evaluated and updated to adapt to changing regulations and emerging cybersecurity risks. Our training program also includes expert guest speakers and additional training during cybersecurity awareness month each October.

While we focus on prevention and detection, we have response and recovery plans in place, as well as service agreements and partner engagements should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. We review the overall incident response plan at least annually or as needed to determine what updates (if any) are necessary. The plan defines the roles and responsibilities of our IT and security teams and other functional teams that comprise the cybersecurity incident response team, as well as provides controls and procedures for timely and accurate reporting of material cybersecurity incidents. Significant cybersecurity incidents are reviewed by a cross-functional team to determine whether further escalation is appropriate. Any incident that potentially is, or may become, material is reported to senior management for materiality and disclosure determinations. We also maintain cyber liability insurance coverage.

Through our enterprise risk management (“ERM”) program, we identify, assess and manage a broad range of risks across the organization. Through the ERM process, cybersecurity has been identified as an important risk facing our business. Accordingly, our cybersecurity risk management program is integrated into our overall ERM program and information about cybersecurity risks and our cybersecurity risk management program is reviewed as part of our ERM program.

As of the date of this report, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially impacted us, including our business strategy, results of operations, or financial condition. However, we cannot provide assurance that we will not experience such an event moving forward and if realized, that we, or our business strategy, results of operations, or financial condition, would not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, “Risk Factors” of