Company: UTZ
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001739566-25-000053
Chunk: 72

Company: Utz Brands, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 72
---
Item 1C. Cybersecurity

Cybersecurity Risk Management

We maintain a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology systems and information.Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, incident reporting channels and governance processes, as those used in our enterprise risk management program. We designed and continue to assess our cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”), which we use as a guide to help us identify, prioritize and manage the cybersecurity risks that could materially affect our business, financial condition or results of operations.Our cybersecurity risk management program includes a Security Incident Response Plan (“SIRP”). Our SIRP provides the Company with the capability of planning, identifying, containing, and tracking cybersecurity incidents experienced by us or our third party service providers. Our SIRP was established to reduce or minimize the impact of cybersecurity incidents on our networks, IT systems, users or business processes. The execution of our SIRP is led by the Chief Information Officer (“CIO”) in conjunction with our Security Incident Response Team, comprised of network, system administrators and cybersecurity experts, who, in the event of incident, together perform a damage assessment, deliver impact notifications and implement containment procedures depending upon the incident. In addition, we also engage third parties on an as needed basis to assess our cybersecurity practices and procedures.Our cybersecurity risk management program also includes:•a multi-layered approach to cybersecurity designed to protect our assets;•identification of key risk areas through internal reviews and researching trends;•ongoing mitigation in the areas of human behavior, data breaches, remote work, third party vendors, removable media and emerging threats;

36

•performance of multiple assessments both internally and externally;•quarterly mandatory security training for employees as well as monthly phishing tests; and•multi-factor authentication.

For the fiscal year ended December 29, 2024, we are not aware of any cybersecurity incidents or risks from cybersecurity incidents that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition.  We cannot guarantee that we may not experience any cybersecurity incidents or risks related to cybersecurity incidents in the future. 

Cybersecurity Governance

We are committed to protecting our information technology (“IT”) assets and data. This commitment includes the protection of IT assets relevant to our operations, employees, customers and suppliers’ data, intellectual property and our products, among others.Our Company Board plays a role in