Company: ACIW
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000935036-25-000006
Chunk: 110

Company: ACI WORLDWIDE, INC.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 110
---
ITEM 1C. CYBERSECURITY

Risk Management Strategy

The oversight of our cybersecurity risk is integrated into our Enterprise Risk Management ("ERM") function and processes and procedures. Our ERM framework integrates our information technology and data management systems and related policies and practices into the larger framework to help guide and prioritize our cybersecurity and information technology-related investments, activities, and risk management strategy. We leverage a variety of risk methodologies and technologies to mitigate the risk of cybersecurity threats and incidents. We have a multi-layer, in-depth approach to technology solutions, including employing applications and tool suites used for perimeter, network, end point and application security, as well as for data recovery, in each case tailored to our systems, data, risk profile and mitigation strategy. At least annually, we review cybersecurity risk as part of our ERM processes and integrate those findings into our overall cybersecurity strategy.  We utilize threat intelligence services from multiple organizations, allowing us to proactively respond to emerging cybersecurity threats. We have also taken steps to address cybersecurity threats at third parties, including service providers, that handle, possess, process, and store our material information. Our Third-Party Risk Management program requires that these third parties maintain certain security controls and we assess their compliance with these requirements.We have a cybersecurity training program that covers a variety of topics designed to educate our employees about the importance of cybersecurity awareness, highlight typical cybersecurity-related risks and issues (such as phishing attacks and other methods used to attempt to infiltrate systems), and test that awareness using knowledge assessments and simulations. The training is administered to employees on an annual basis, and we use a third-party provider for the content to ensure that the training is periodically updated to incorporate new cybersecurity-related developments and best practices.      In the event of a reported potential cybersecurity incident, the Global Information Security team ("GIS") determines whether such incident triggers our cybersecurity threat evaluation and response plan (the “Response Plan”). If triggered, our cybersecurity response team, which includes representatives from GIS, our business team, and executive leadership, as needed under the circumstances (the “Cyber Response Team”), is convened. Members of the Cyber Response Team are responsible for developing, recommending and implementing the necessary measures to address the cybersecurity incident, including assessing, containing and mitigating its impact, notifying members of our management, the Audit Committee and the full Board of the cybersecurity incident, and coordinating external communications, in each case as appropriate under the circumstances. The Cyber Response Team is responsible for implementing and monitoring the effectiveness of any remediation plan adopted as a result of the cybersecurity incident.