Company: GPI
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0001031203-25-000013
Chunk: 107

Company: GROUP 1 AUTOMOTIVE INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 107
---
 IT systems could have significant consequences to our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Item 1A. Risk Factors for additional information about the risks to our business associated with a breach or compromise to our IT systems.

Board of Directors’ Oversight of Risks from Cybersecurity ThreatsThe Board of Directors oversees risks from cybersecurity threats. The Board of Directors delegates oversight of our operations risk, including quarterly reviews of cybersecurity and data protection, to the Finance/Risk Management Committee, and delegates compliance with cybersecurity policies to the Audit Committee. Both the Finance/Risk Management Committee and the Audit Committee report to the full Board of Directors on cybersecurity matters. Additionally, on an annual basis, management reviews results from tests of key cybersecurity systems with the full Board of Directors and the steps taken to mitigate new cybersecurity risks which have been identified.The Finance/Risk Management Committee oversees the formal process to identify risks company-wide, allocate them to the appropriate committee of the Board of Directors, and ensure that risk mitigation activities are being followed. At each of its meetings, the Finance/Risk Management Committee receives presentations from our Chief Information Officer (the “CIO”) on cybersecurity and information security risk, as well as our cybersecurity initiatives.The Audit Committee oversees compliance with cybersecurity policies with guidance from members of management, including the Vice President of Internal Audit, who informs the Audit Committee on the audit results of cybersecurity controls. Management’s Role in Assessing and Managing Cybersecurity ThreatsOur IT and Security team, which is headed by our CIO, is responsible for our efforts to comply with cybersecurity standards, establish industry-recognized protocols and protect the integrity, confidentiality and availability of our IT infrastructure. Our CIO and various members of the IT and Security team, meet regularly with members of management to address key security and privacy issues. Our CIO has more than 25 years of infrastructure and cybersecurity experience. We also have formed a cyber event incident team, composed of our CIO, Chief Financial Officer, Corporate Controller, Chief Legal Officer and vice president of Internal Audit, who, upon the occurrence of a cybersecurity incident, convene to assess the materiality of the event as well as the appropriate remediation and escalation procedures, including escalation to our Chief Executive Officer, the Finance/Risk Management Committee, the Audit Committee and the Board of Directors. Our internal audit department additionally conducts regular audits to assess management’s processes and controls employed to identify and manage material cybersecurity risks.