Company: ALGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001097149-25-000012
Chunk: 90

Company: ALIGN TECHNOLOGY INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 90
---
 conduct evaluations of our security controls, including penetration testing and independent audits. Annually, an external auditor conducts a System and Organization Controls (“SOC”) type 2 audit covering the security principle for systems supporting our products. Our assessment of risks associated with the use of third-party vendors is part of our overall cybersecurity risk management framework. If a third-party vendor is unable to provide a SOC 1 or SOC 2 report, our information security team takes additional steps to assess its cybersecurity preparedness and our initiation or continued engagement with it. Additionally, third-party vendors are required to include security and privacy addenda to our contracts where determined applicable and are reassessed periodically as necessary depending on the risk level that has been assigned to the third-party vendor. Our legal team also requires that our third-party vendors report cybersecurity incidents to us so the impact of the incident on us can be assessed. As of the date of this Annual Report on Form 10-K, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Notwithstanding the approach we take to cybersecurity, we may not successfully prevent or mitigate cybersecurity incidents that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be covered or, if covered, fully insured. For a discussion of our cybersecurity-related risks, see Part I, Item 1A of this Annual Report on Form 10-K under the heading “Risk Factors.”

Governance

Role of ManagementTo more effectively assess and manage cybersecurity threats, we have a dedicated Chief Information Security Officer (“CISO”) who is responsible for leading enterprise-wide information security strategy, policy, process, and technology. Our current CISO has 20+ years of information security and risk management experience and holds a Certified Information Systems Security Professional (CISSP) certification. Our CISO regularly briefs our Audit Committee on our cybersecurity and information security program and cybersecurity incidents deemed to pose a risk of a critical business impact or reputational harm.Our information security team, comprised of employees with an expertise in cybersecurity and information technology, regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and response. Our information security team annually performs a cybersecurity enterprise risk assessment and presents the results to management and the Audit Committee. In addition, our internal audit team conducts periodic audits of the Company’s