Company: ALGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001097149-25-000012
Chunk: 89

Company: ALIGN TECHNOLOGY INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 89
---
Item 1C.  Cybersecurity. 

OverviewWe have implemented a cross-functional information security program to assess, identify and manage material risks from cybersecurity risk, which includes seeking input from our employees, management, third-party vendors, the Audit Committee of the Board of Directors (“Audit Committee”) and the Board of Directors. Our information security program’s ultimate goal is preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. In the event of an identified cybersecurity incident, we have developed a detailed cybersecurity incident response process, which outlines the steps to be followed from incident detection, analysis, containment, eradication, recovery and notification, including notifying functional areas (e.g. information technology, legal, finance, operations, privacy), as well as senior leadership and the Audit Committee, as appropriate. In certain instances, incidents are escalated to certain members of our legal team who are responsible for, among other things, the accurate and timely disclosure of material cybersecurity incidents required under federal securities laws, including making the materiality determination and approving related securities disclosures.Risk Management and StrategyOur information security program devotes significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and response. Our information security program leverages the National Institute of Standards and Technology (NIST) and International Organization for Standardization (ISO) 27001 frameworks choosing to organize our cybersecurity risks into five categories: identify, protect, detect, respond and recover. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST and ISO frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.Our information security program is integrated into our overall enterprise risk management program. Our information security program includes, among other things: •cybersecurity incident response;•vulnerability management;

35

•antivirus and malware protection;•technology compliance and risk management; •encryption; •identity and access management; •application security; and•security monitoring. Our information security program also includes an information security awareness program, which includes annual training regarding our acceptable use and information classification and handling policies, regular phishing campaigns complemented by additional employee training as appropriate, and communications and companion trainings to keep users informed on current events. Our information security team engages third-party services to