Company: LW
Filing Date: 2025-07-23
Form Type: 10-K
Source: 0001679273-25-000049
Chunk: 74

Company: Lamb Weston Holdings, Inc.
Filing Date: 2025-07-23
Form: 10-K
Item: Item 1C
Chunk 74
---
ITEM 1C. CYBERSECURITY

Risk Management and Strategy 

We assess, identify, and manage material risks from cybersecurity threats through our cybersecurity risk management program. This program includes cybersecurity policies, standards, and procedures, a cybersecurity incident response plan, regular risk assessments, including as part of our annual enterprise risk management (“ERM”) assessment, testing of the Company’s internal infrastructure to identify vulnerabilities, cybersecurity insurance, procedures for recovering from disruptions to our operations, workforce cybersecurity trainings, and third-party assessments and programs. We maintain a cybersecurity incident response plan to help enable timely, consistent responses to actual or attempted cybersecurity incidents impacting the Company. This plan provides guidance to address the overall coordination of our response to a cybersecurity crisis and plan for resources, actions, and decisions we may need to be prepared for; a communication plan for timely and accurate dissemination of evolving information to stakeholders during the crisis; and business continuity plans that document strategies and measures to enable core business activities to continue during a cybersecurity event. To support our cybersecurity incident response plan, we conduct exercises simulating cybersecurity incidents to educate and train our management on response capabilities and inform adjustments to our controls and response. We have engaged third-party cybersecurity firms to advise on these exercises. The status and ongoing enhancement of our cybersecurity risk management program is reported to senior management, as well as the Audit Committee of our Board, on a quarterly basis, or more frequently as warranted.

As part of our broader risk management and control framework, we have implemented cybersecurity controls over the information technology and process control systems of the Company and of our third-party service providers, to support the oversight, identification, and remediation or mitigation of risks from cybersecurity threats. We engage third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer, and vendor data as well as data affecting our process controls and data used to operate our manufacturing facilities. As part of our cybersecurity risk management program, we conduct information security and data protection training for employees, including training on matters such as phishing, social engineering, cybersecurity awareness, and email security best practices. In addition, we work with third-party providers to undertake penetration testing and maturity assessments of the Company’s information security program based on the National Institute of Standards and Technology cybersecurity framework. With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement. Further, after engagement, we periodically perform information security assessments of certain third-party service providers that we consider critical to our operations. In addition, in new or amended