Company: CZR
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001590895-25-000068
Chunk: 858

Company: Caesars Entertainment, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 858
---
Item 1C.    Cybersecurity

Risk management and strategy

We maintain a cybersecurity team responsible for the development and implementation of a program intended to protect the confidentiality, integrity and availability of our critical systems and information. A component of our program is a cybersecurity Incident Response Plan (“IRP”) which has been built by the team utilizing current and historical industry knowledge and experience.Key elements of our risk management procedures and processes include: •risk assessments to help mitigate material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment;•a team composed of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents;•the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;•formal information security training program for all team members as well as supplemental training on specific matters such as phishing and email security best practices;•a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents;•attack and response simulations at the technical level and execute tabletop response exercises at the management level;•a third-party risk management process for service providers; and•cybersecurity insurance to cover certain expenses in the event of a cybersecurity incident.The cybersecurity team reports to the Chief Information Officer (“CIO”) and in January 2024, we hired a Chief Information Security Officer (“CISO”) with significant experience in leading cybersecurity teams to assume the leadership of management’s responsibilities and governance discussed below.

Table of Contents29

We evaluate our cybersecurity risk management processes and continue to integrate our procedures into our overall enterprise risk management program, which shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.Incidents are investigated by the cybersecurity team as they are identified and may be resolved or escalated based upon the specific details and severity of each incident. Incidents are evaluated throughout the investigation and remediation processes and incidents determined to be insignificant may be resolved by the cybersecurity team without further escalation at that time. Incidents determined to be more severe, such as those that may have compromised the confidentiality, integrity and availability of our critical systems and information, are escalated by the cybersecurity team to notify legal counsel, our Cybersecurity & Privacy Executive Steering Committee, our Board of Directors, or various regulators, as required. Our cybersecurity team evaluates the