Company: CPS
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0001320461-25-000033
Chunk: 35

Company: Cooper-Standard Holdings Inc.
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 35
---
 the relationship, and periodically throughout the relationship. We evaluate several aspects of information security, utilizing guidance from globally recognized frameworks (e.g., ISO/IEC 27001:2022). In addition to these point-in-time reviews, we continuously monitor the security posture of critical third parties through a third-party service. Critical service providers are also required to submit independently certified assurance of their security controls based on internationally recognized standards (e.g., ISEA 3402, SOC 1, SOC 2, etc.). Finally, upon relationship termination, we ensure each third party is properly offboarded, addressing critical cybersecurity concerns such as eliminating access and obtaining and/or deleting Company data.Cooper Standard continuously works to update and strengthen our Incident Response (“IR”) program, which defines response procedures and prescriptive controls designed to streamline response to incidents, when and if they occur. Our designated cross-functional Incident Response Team (“IRT”) consists of leaders from human resources, global communications, legal, internal audit and information technology. Cooper Standard’s IRT is dedicated to maintaining a culture of continuous improvement, taking into consideration lessons learned from table-top exercises and feedback from the third-party expert with whom we annually contract.While we have experienced threats to our data and systems, to date, we have not experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition. That said, a significant cybersecurity incident may materially impact the Company’s business strategy, results of operations and financial condition in the future. For further information regarding cybersecurity risks to the Company, see Part 1, Item 1A, Risk Factors, “A disruption in, or the inability to successfully implement upgrades to, our information technology systems, including disruptions relating to cybersecurity as well as data privacy concerns, could adversely affect our business and financial performance.”

GovernanceWe align our cybersecurity and IT compliance programs to take advantage of natural synergies and our IT controls environment. Our Senior Vice President, Chief Information Technology Officer, who has more than 25 years of experience in technology and information security risk management in our industry and across a number of organizations, is responsible for overseeing the risks related to cybersecurity. Our cybersecurity team holds several cybersecurity industry certifications such as ISC2 CISSP, ISACA CISM and EC-Council CEH.The Cooper Standard IT leadership team manages the global cybersecurity and IT compliance organization, and the Senior Vice President, Chief Information Technology Officer directly reports updates to the Audit Committee of the Board of Directors at least twice annually and the full Board of Directors at least annually. Further, our