Company: PBH
Filing Date: 2025-05-09
Form Type: 10-K
Source: 0001295947-25-000017
Chunk: 57

Company: Prestige Consumer Healthcare Inc.
Filing Date: 2025-05-09
Form: 10-K
Item: Item 1C
Chunk 57
---
ITEM 1C.  CYBERSECURITY

Cybersecurity Risk Management and StrategyWe recognize the importance of data privacy and security and are committed to safeguarding and protecting our own confidential information and other confidential information shared with us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of all our critical systems and information, which is integrated into our overall risk management program.  This cybersecurity risk management program involves the strategic planning, operation, implementation and monitoring of cybersecurity practices within our organization. Our cybersecurity program also includes a comprehensive incident response plan ("IRP") to respond to security breaches and cyberattacks. In addition, our cybersecurity IRP is part of our overall Information Security Program, which is led by the Company’s Information Technology ("IT") Vice President ("VP") and Chief Information Security Officer ("CISO") and is overseen by the Company’s Chief Financial Officer & Chief Operating Officer ("CFO & COO"). The IRP is designed to protect and preserve the confidentiality, integrity and continued availability of all confidential information in the care of the Company and the information systems owned or used by the Company, as well as the Company’s ability to operate. Our cybersecurity IRP includes controls and procedures for timely and accurate reporting of any cybersecurity incident.  In accordance with the plan, material cybersecurity incidents are escalated to the Audit Committee of the Board of Directors.  We design and assess our program based on the NIST Cybersecurity Framework.Our cybersecurity risk management program includes the following:•An ongoing process of identifying, evaluating and addressing our cybersecurity threats;•A security team responsible for managing our cybersecurity risk, assessment processes, security controls and responses for security breaches and cyberattacks;•The use of external service providers, where appropriate, to assess, perform tabletop exercises, or otherwise assist with aspects of our security controls designed to anticipate cyberattacks and respond to breaches.  Procedures include annual internal vulnerability scans and external penetration tests;•Regular cybersecurity awareness training for all employees to provide a better understanding of the issues and risks related to cybersecurity and data privacy.  We realize that cybersecurity is not just the job of the IT security team; the Company and all employees play a critical role in managing the risk; •Phishing and other exercises performed by our IT department periodically throughout the year to test our systems and reinforce the training provided to all personnel;•A cybersecurity incident response plan managed by our VP of IT/CISO, which includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity