Company: PRGO
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001585364-25-000014
Chunk: 406

Company: PERRIGO Co plc
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 406
---
 and cybersecurity awareness program designed to educate and test employee maturity at least annually, and regularly throughout the year employees receive training regarding phishing and other threat actor schemes, the inherent risks involved in human interaction with information and operational technology, and new and emerging technologies.We have processes in place designed to allow us to oversee and identify risks from cybersecurity threats associated with our use of third party service providers and suppliers through our Supplier Cyber Risk Assessment process, which assesses third-party cybersecurity controls through a combination of risk assessment questionnaires, commercially available risk data and security rating platforms. We also include cybersecurity and information security language in our contracts where applicable. We require our suppliers and partners to report cybersecurity incidents to us so that we can assess the impact of such an incident on us and have dedicated processes to respond to cybersecurity incidents at third parties. We have established processes to contain the impact of potential security incidents on Perrigo's third party service providers.

33

Perrigo Company plc - Item 1CCybersecurity

As of December 31, 2024, we are unaware of any risks from cybersecurity threats (including previous cybersecurity incidents) that may have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. We have experienced and may continue to experience cybersecurity incidents; however, we do not believe any cybersecurity incidents incurred to date have materially affected our Company, including our business strategy, results of operations, or financial condition. While we continue to employ resources to monitor our systems and protect our infrastructure, these measures may prove insufficient, and that could subject us to significant risks. For further discussion of how these and other potential cybersecurity risks may impact our business, refer to the risk factor under heading “A cybersecurity breach, disruption or misuse of our information systems, or our external business partners’ information systems could have a material adverse effect on our business” in Item 1A. Risk Factors – Operational Risks.

GOVERNANCE 

Our overall information security efforts are led by the Chief Information Security Officer ("CISO"). The CISO has substantial experience in cybersecurity, including knowledge, skills, certifications, and background in the field. The CISO holds several key certifications including Certified Information Systems Security Professional ("CISSP"), Certified Secure Software Lifecycle Professional ("CSSLP") and Certified Ethical Hacker ("CeH"). While management is responsible for day-to-day risk management, the Board of Directors is responsible for the Company’s overall risk oversight function, including cybersecurity risks, and includes oversight by several committees. The NGC, comprised solely of independent